CVE-2026-68765 hashcat CVE debrief

Who should care

Security teams and administrators responsible for hashcat installations, particularly those using master branch builds after v7.1.2, should be aware of this vulnerability and take steps to verify and mitigate potential risks.

Technical summary

The CVE-2026-68765 vulnerability is a heap buffer overflow in the KeePass AESKDF/KDBX v4 module of hashcat master branch builds after v7.1.2. The vulnerability occurs when an oversized ninth hash field token is supplied, allowing attackers to corrupt adjacent heap memory. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, potentially enabling heap corruption or memory access violations.

Defensive priority

Medium priority due to potential heap corruption or memory access violations via adjacent heap memory corruption in hashcat master branch builds after v7.1.2.

Recommended defensive actions

• Inventory and verify hashcat master branch builds after v7.1.2 for potential vulnerability to heap buffer overflow via oversized ninth hash field token.
• Implement compensating controls to detect and prevent potential heap corruption or memory access violations.
• Monitor for and apply vendor remediation or patches for the vulnerable hashcat module.
• Perform exception tracking and retest vulnerable hashcat configurations.
• Review official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-68765 record indicates a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module of hashcat master branch builds after v7.1.2. The vulnerability allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check.

Official resources