CVE-2026-68765

Received Received - Intake

Heap Buffer Overflow in hashcat KeePass AESKDF/KDBX v4 Module

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-68765

Affected Vendors & Products

Vendor	Product	Version / Range
hashcat	hashcat	From 7.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 module (module 34301). It occurs when an oversized ninth hash field token is supplied, causing the module to write beyond its fixed 256-byte buffer into adjacent memory. This can corrupt heap data or trigger memory access violations.

Detection Guidance

This vulnerability is specific to hashcat builds after v7.1.2 and involves a heap buffer overflow in the KeePass AESKDF/KDBX v4 module. Detection requires checking hashcat version and module usage. No direct network detection commands are applicable.

Impact Analysis

An attacker could exploit this to corrupt memory, crash hashcat, or potentially execute arbitrary code. Since hashcat is used for password cracking, this might allow unauthorized access to hashed passwords or sensitive data if the corruption affects processing logic.

Mitigation Strategies

Upgrade hashcat to a version prior to v7.1.2 or apply patches addressing the KeePass AESKDF/KDBX v4 module heap overflow. Avoid using vulnerable hashcat builds for KeePass decryption tasks.

Hi! I’m here to help you understand CVE-2026-68765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70