CVE-2026-60060
Received Received - Intake

Improper Input Handling in Tera Term TTSSH2 Plugin

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: JPCERT/CC

Description
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-60060
EUVD
EUVD-2026-45139

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teraterm_project ttssh2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Handling of Length Parameter Inconsistency (CWE-130) in the TTSSH2 plugin of Tera Term. When Tera Term tries to connect to a malicious server via SSH, it may read or write outside the intended memory bounds. This could cause Tera Term to send adjacent memory contents to the attacker and behave unpredictably or crash.

Detection Guidance

This vulnerability is specific to the TTSSH2 plugin in Tera Term versions 3.6.1 and earlier. Detection primarily involves checking the installed version of Tera Term and TTSSH2. No direct network or system commands are provided in the resources to detect active exploitation. However, you can verify if your system is vulnerable by checking the installed Tera Term version with commands like 'ttssh2 -v' or inspecting the plugin version in the Tera Term installation directory.

Impact Analysis

If exploited, this flaw could allow an attacker to access sensitive data in memory, disrupt Tera Term's operation, or cause it to crash during SSH connections. This may lead to information leakage or denial of service for users relying on the TTSSH2 plugin.

Compliance Impact

This vulnerability could potentially lead to unauthorized data exposure, which may violate compliance requirements under GDPR or HIPAA if sensitive data is leaked. Organizations using Tera Term with TTSSH2 may need to assess their risk and apply mitigations to maintain compliance.

Mitigation Strategies

Update Tera Term to the latest version to address the improper handling of length parameter inconsistency in the TTSSH2 plugin. Avoid connecting to untrusted SSH servers until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart