WinSCP 6.5.7 Released: Critical Security Fixes for PuTTY and OpenSSL Vulnerabilities

WinSCP, the popular free SFTP/FTP/SCP client for Windows, has released version 6.5.7 and unlike most point releases, this one is worth installing promptly. It bundles a set of security fixes inherited from the PuTTY project along with an OpenSSL vulnerability patch, on top of the usual translation updates.

What's New

• PuTTY core upgraded to 0.85, bringing fixes for:
  • A remotely triggerable use-after-free in Pageant.
  • A remotely triggerable buffer overflow when OpenSSH's encrypt-then-MAC cipher modes are in use.
  • A buffer overflow in private key decryption triggered by a maliciously crafted key.
  • A denial-of-service issue where a malicious server (or a man-in-the-middle) could force WinSCP into a tight loop or unbounded memory use at startup.
  • A remotely triggerable double-free in RSA key exchange.
  • A remotely triggerable crash in NIST ECDSA signature verification.
• OpenSSL fix (CVE-2026-45447) — patches a use-after-free that could be triggered by a specially crafted PKCS#7 or S/MIME signed message.
• Bug fix carried over from the 6.6.2 beta: Session.DebugLogPath failing to set correctly when running in an impersonated context.
• Completed translations for Croatian, Finnish, Georgian, Italian, and Serbian, with an update to Slovenian.

Given the number of remotely triggerable issues patched here, anyone using WinSCP to connect to untrusted or public-facing servers should update without delay.

Download

Get it from the official WinSCP download page, or update in-app via Check for Updates.

Reference: WinSCP on UpdateStar