CVE-2026-118673 in KeePassXC
Summary
by MITRE • 10/29/2026
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within KeePassXC versions ranging from 2.3.0 through 2.8.0 represents a critical memory safety flaw located specifically within the browser integration module, particularly in the source file BrowserMessageBuilder.cpp. This component is responsible for handling communication between the password manager and external web browsers via an IPC endpoint. The core technical deficiency stems from an incorrect allocation strategy when preparing encrypted responses using the Botan::Sodium library function crypto_box_easy(). While this cryptographic primitive correctly calculates that a ciphertext must be sized to accommodate both the plaintext data length and the additional MACBYTES required for authentication, the application erroneously allocates a fixed output vector of one megabyte regardless of the actual input size. This discrepancy between expected memory requirements and allocated buffer space creates a dangerous condition where the encryption routine writes beyond the intended boundaries if the resulting ciphertext exceeds the bounds of any smaller pre-allocated buffers or if internal logic misinterprets the allocation, leading to sequential out-of-bounds write operations before the response is delivered to the client.
From an operational perspective, this vulnerability requires specific conditions to be successfully exploited. An attacker must possess a browser-based protocol client capable of accessing the per-user IPC endpoint associated with KeePassXC. Furthermore, the attacker needs to establish a valid database association and ensure that the target database remains unlocked during the attack window. By triggering the generation and encryption of an authorized response involving sufficiently large data payloads, the attacker can induce memory corruption through sequential out-of-bounds writes. This type of heap-based or stack-based buffer overflow can lead to arbitrary code execution, denial of service conditions due to application crashes, or potential information disclosure depending on how the overwritten memory is utilized by subsequent operations within the process space. The severity is heightened because browser integration often runs with elevated privileges relative to web content and may interact directly with sensitive credential storage mechanisms.
This flaw aligns closely with CWE-787: Out-of-bounds Write, as it involves writing data beyond the allocated buffer boundaries due to improper size calculations or fixed-size assumptions in dynamic contexts. Additionally, because the vulnerability is triggered via interaction with a browser extension through an IPC mechanism, it relates to CWE-209: Generation of Error Message Containing Sensitive Information if side channels are involved, but primarily falls under CWE-1346: Improper Verification of Cryptographic Signature or more accurately CWE-787 in the context of memory corruption. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with Tactic TA0005: Defense Evasion and specifically Technique T1203: Exploitation for Client Execution, as an attacker could leverage the browser integration to execute malicious code within the context of the KeePassXC process. The exploitation path leverages the trust relationship between the browser extension and the desktop application, allowing remote attackers in a local or network-adjacent position to compromise system integrity if they can interact with the IPC endpoint.
Mitigation strategies for this vulnerability are primarily centered around immediate software updates. Users running any version of KeePassXC from 2.3.0 up to and including 2.8.0 must upgrade to version 2.8.1 or later, where the issue has been resolved by correcting the memory allocation logic in BrowserMessageBuilder.cpp to dynamically size buffers based on actual cryptographic output requirements rather than relying on fixed allocations that do not account for MAC overhead correctly. In environments where immediate patching is not feasible, administrators should consider disabling browser integration features if they are not actively used, thereby removing the attack surface associated with the IPC endpoint and message handling routines. Additionally, enforcing strict access controls on local user accounts can limit the ability of unauthorized processes to interact with the KeePassXC IPC interface, although this provides defense in depth rather than a complete solution given that browser extensions typically run under the same user identity as the main application.