Bug 2517630 (CVE-2026-68765)

Summary: CVE-2026-68765 hashcat: hashcat: Heap Buffer Overflow via oversized hash field token
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in hashcat. Attackers can exploit a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module by providing an oversized ninth hash field token. The module processes input up to 600 hexadecimal characters into a fixed 256-byte buffer without proper length validation. This can lead to heap memory corruption or memory access violations, potentially resulting in a denial of service or other unpredictable behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2521897    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-17 21:03:07 UTC 
hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations.