CVE-2026-86776 in KeePass
Summary
by MITRE • 09/09/2026
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in KeePass password manager versions 2.35 through 2.61.1 represents a critical resource exhaustion flaw rooted in improper input validation during the parsing of KDBX database files. The core technical deficiency lies within the ReadHeaderField function, which is responsible for processing metadata and structural information at the beginning of an encrypted database file. When KeePass opens a KDBX file, it must parse various header fields to determine how much memory needs to be allocated for subsequent data structures. In vulnerable versions, this process fails to validate whether the declared sizes of these header fields are reasonable or within expected bounds before initiating memory allocation requests. This lack of pre-allocation validation allows an attacker to craft a malicious KDBX file that contains artificially inflated size values in its header section.
When such a crafted file is opened by the application, KeePass proceeds to allocate memory based on the unvalidated field sizes without checking for integer overflow or logical limits. Because the software trusts these declared lengths implicitly, it attempts to reserve gigabytes of contiguous RAM space as specified by the malicious payload. This action triggers an immediate and severe denial of service condition. The operating system may either reject the allocation due to insufficient physical memory and swap space, leading to a crash, or allow the allocation if sufficient resources are temporarily available but rapidly deplete them. In either scenario, the application becomes unresponsive or terminates abruptly, effectively denying access to any legitimate password data stored in that instance of KeePass. This behavior aligns with CWE-400, which describes conditions where an action is not limited by resource limits, leading to exhaustion of resources such as memory, CPU time, or disk space.
The operational impact of this vulnerability extends beyond simple application instability. For users who rely on KeePass for daily security operations, a crash caused by opening a malicious file can result in the loss of unsaved work if auto-save features are not configured correctly or have failed to trigger before the termination event. Furthermore, while the primary vector is denial of service, such memory corruption issues often serve as precursors to more severe exploits like arbitrary code execution if similar flaws exist elsewhere in the parsing logic. The vulnerability highlights a fundamental principle failure in secure coding practices where input data from untrusted sources must always be validated against expected constraints before being used for resource management decisions. This specific flaw is particularly dangerous because KDBX files are often shared between users or downloaded, increasing the attack surface significantly compared to isolated local operations only.
From an offensive security perspective, this vulnerability can be mapped to MITRE ATT&CK technique T1496, which covers Resource Hijacking, specifically under sub-techniques related to denial of service through resource exhaustion. An attacker could distribute a malicious KDBX file via phishing emails or compromised websites, relying on the user's trust in KeePass to open it without suspicion. The resulting crash disrupts productivity and can be used as part of a broader campaign to degrade security posture by forcing users into less secure alternatives or causing frustration that leads to poor password hygiene practices later. It is important to note that this vulnerability does not directly compromise the confidentiality of encrypted data since the encryption keys are processed after header parsing, but it effectively neutralizes the availability aspect of the CIA triad for the affected system.
Mitigation strategies primarily involve updating KeePass to version 2.61.2 or later, where developers have implemented proper validation checks within the ReadHeaderField function and related memory allocation routines. These updates ensure that field sizes are checked against maximum allowable limits before any significant memory is reserved. In environments where immediate patching is not feasible, administrators should enforce strict file integrity policies and restrict the opening of KDBX files from untrusted sources using application whitelisting or sandboxed execution environments. Additionally, users should be educated to verify the source of database files they intend to open and to maintain regular backups of their password databases in secure, offline locations to mitigate data loss risks associated with potential crashes. Regular security audits focusing on input validation patterns can help identify similar vulnerabilities in other components of the KeePass codebase or related tools that parse binary formats without adequate boundary checks.