CVE-2026-68768 in hashcat
Summary
by MITRE • 08/22/2026
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in Hashcat represents a critical heap-based buffer overflow located within the outfile_write function of the src/outfile.c source file. This flaw arises from an insufficient validation mechanism when assembling output data into a fixed-size memory buffer, specifically defined by the constant HCBUFSIZ_LARGE which allocates approximately sixteen megabytes of space. The core technical failure lies in the sequential appending process where the application concatenates multiple distinct components: the username, a separator character, the cryptographic hash itself, and finally the plaintext password candidate. These elements are combined using memcpy operations without any prior calculation or runtime check to ensure that the cumulative length of these concatenated strings remains within the allocated boundaries of the target buffer. This lack of bounds checking creates a classic out-of-bounds write condition where data is written past the end of the intended memory region, directly into adjacent heap structures.
From an operational perspective, this vulnerability can be triggered by providing crafted input through specific command-line arguments that force the application to process oversized usernames while simultaneously displaying results. Specifically, executing Hashcat with the --username and --show flags against a specially constructed hash file containing a username of sufficient length allows an attacker or malicious user to exceed the buffer capacity. When the total size of the assembled output string surpasses the sixteen-megabyte limit, the excess data overwrites adjacent memory on the heap. This corruption can lead to immediate process crashes due to segmentation faults or more severe consequences such as arbitrary code execution if the overwritten memory regions contain function pointers or control structures that an attacker can manipulate. The impact is particularly significant in scenarios where Hashcat is run with elevated privileges or against untrusted input sources, as it compromises both the integrity of the application and potentially the underlying system stability.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. The exploitation vector involves providing external input that is not properly validated for length constraints before being copied into a fixed-size buffer, which is a fundamental security design flaw in memory management practices. In the context of the MITRE ATT&CK framework, this type of vulnerability facilitates techniques related to Execution via Client Software or potentially Privilege Escalation if combined with other exploitation methods that leverage heap corruption for control flow hijacking. The absence of boundary checks during string assembly operations is a common pitfall in C and C++ applications, highlighting the necessity for rigorous input validation and safer memory handling functions.
Mitigation strategies must focus on implementing strict length verification before any memcpy or similar buffer manipulation occurs. Developers should calculate the total required size by summing the lengths of all components including separators and null terminators, ensuring this value does not exceed HCBUFSIZ_LARGE prior to initiating the copy operation. If the input exceeds available space, the application should either truncate the output safely, return an error code indicating insufficient buffer capacity, or dynamically allocate a larger buffer if memory constraints permit. Additionally, employing static analysis tools and fuzzing techniques during the development lifecycle can help identify such boundary violations early. For users currently running vulnerable versions of Hashcat, it is advisable to avoid processing untrusted hash files with oversized usernames when using display modes that trigger this code path until an official patch addressing the buffer validation logic is released by the maintainers.