Hashcat KeePass AESKDF/KDBX v4 heap-based overflow

Summaryinfo

A vulnerability identified as problematic has been detected in Hashcat. This vulnerability affects unknown code of the component KeePass AESKDF/KDBX v4 Module. Performing a manipulation results in heap-based overflow. This vulnerability is cataloged as CVE-2026-68765. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Hashcat (affected version not known). This affects some unknown functionality of the component KeePass AESKDF/KDBX v4 Module. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on integrity, and availability. The summary by CVE is:

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-68765 since 07/31/2026. The exploitability is told to be easy. An attack has to be approached locally. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Applying the patch 6f374c4 is able to eliminate this problem.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Hashcat

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion