CVE-2026-68767 in hashcat
Summary
by MITRE • 08/22/2026
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in Hashcat involves a critical off-by-one error within the fgetl() function located in src/filehandling.c. This specific implementation flaw results in an out-of-bounds heap write, which occurs when the input line being processed is exactly equal to the buffer size defined by HCBUFSIZ_LARGE. The root cause lies in how the string termination character is handled during memory allocation and copying operations. When a line of text matches the maximum buffer capacity precisely, the function fails to account for the additional byte required to store the null terminator that marks the end of a C-style string. Consequently, the write operation extends one byte beyond the allocated heap region, corrupting adjacent memory structures.
From a technical perspective, this is classified as CWE-193: Off-by-One Error, which falls under the broader category of CWE-787: Out-of-bounds Write. The vulnerability exploits standard string handling practices where developers assume that input data will always be shorter than the buffer size to leave room for termination characters. In this case, an attacker can craft a malicious file such as a hash list, potfile, or wordlist containing a single line with exactly HCBUFSIZ_LARGE bytes of content. When Hashcat processes this file during its initialization or execution phase, it invokes fgetl() to read the input. The function allocates memory based on the expected size but writes the null byte at index equal to that size rather than size minus one. This action overwrites heap metadata or adjacent objects in the memory allocator's data structures.
The operational impact of this vulnerability is significant due to its potential for remote code execution and denial of service. Because the corruption occurs within the heap, an attacker with control over the input file can potentially manipulate the heap layout to achieve arbitrary write primitives. By carefully crafting subsequent allocations or freeing operations following the initial overflow, a sophisticated attacker could overwrite function pointers or object vtables, leading to arbitrary code execution under the context of the user running Hashcat. Even without achieving full code execution, the memory corruption can cause immediate application crashes, resulting in a denial of service condition that disrupts password cracking workflows and potentially leads to data loss if critical state information is corrupted.
This vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter, as it involves manipulating input files used by the tool for processing. It also relates to T1203: Exploitation for Defense Evasion if an attacker uses this flaw to bypass security controls or hide malicious activity within legitimate cracking sessions. The attack vector is primarily local file manipulation, meaning the victim must be persuaded to process a specially crafted input file provided by the attacker. This could occur through social engineering where a user opens a compromised wordlist or hash set downloaded from an untrusted source.
Mitigation strategies should focus on both immediate patching and long-term defensive coding practices. The primary remediation is for Hashcat developers to update the fgetl() function in src/filehandling.c to ensure that memory allocation accounts for the null terminator byte, thereby preventing writes beyond the allocated buffer boundary. This typically involves allocating HCBUFSIZ_LARGE plus one byte or strictly limiting input length to HCBUFSIZ_LARGE minus one before copying data into the fixed-size buffer. For users unable to immediately update their software, mitigations include validating and sanitizing all input files prior to processing them with Hashcat. Implementing strict file size limits in wrapper scripts or using tools like awk or sed to truncate lines longer than a safe threshold can prevent triggering this condition. Additionally, enabling heap protection mechanisms such as Address Sanitizer during development and deployment of custom builds can help detect similar issues early in the software lifecycle. Regular security audits focusing on C-style string handling are essential to identify other potential off-by-one errors across the codebase.