CVE-2026-68767: falha de média gravidade em hashcat
hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
hashcat · hashcatCVEs relacionadas — hashcat
No mesmo produto, das mais perigosas para as menos.
CVE-2026-68766HIGHhashcat through 7.1.2 Arbitrary File Write via Restore File Option InjectionEPSS 0.2%CVE-2026-68768MEDIUMhashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized UsernameEPSS 0.2%CVE-2026-68765MEDIUMhashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token FieldEPSS 0.2%
Referências
https://github.com/hashcat/hashcathttps://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249https://github.com/hashcat/hashcat/issues/4739https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl