PuTTY versions prior to 0.84 contain an assertion failure that is triggered during ECDSA host key verification. When the client processes an ECDSA key that causes the internal assertion to fail, PuTTY aborts, resulting in a client‑side crash and a denial‑of‑service condition for the user. The weakness is classified as CWE‑617, which describes failures to properly control program flow leading to unsafe termination.

The flaw affects all installations of PuTTY version 0.71 through 0.83 on any operating system because the vulnerability exists up to (but not including) 0.84. The product is listed by the CNA as PuTTY:PuTTY, and any user running one of those versions may experience an unexpected crash.

The moderate CVSS score of 3.7 reflects the limited impact and lack of remote code execution. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the attack does not provide a privileged or persistent compromise. The vulnerability is not catalogued in the CISA KEV list. The likely attack vector is a normal SSH session to a server that presents a malformed or deliberately crafted ECDSA host key; the client then aborts. Because the flaw only terminates the client, the risk is restricted to service disruption rather than credential theft or system compromise.