Description

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-17T21:16:48.113Z",
  "pubdate": "2026-08-17T21:16:48.113Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in hashcat master branch builds after v7.1.2 within the KeePass AESKDF/KDBX v4 module (module 34301).\nThe vulnerability allows an attacker to corrupt adjacent heap memory by supplying an oversized ninth hash field token.\nThe affected product is hashcat, specifically impacting module 34301 handling KeePass cryptographic parameters.\nSuccessful exploitation can result in heap corruption, memory access violations, or potentially unpredictable application behavior due to out-of-bounds writes.\nAttacker capabilities require supplying a crafted, oversized input payload containing a malformed ninth token field exceeding expected constraints.\nThe risk implications involve memory integrity compromise during hash processing routines within the cracking pipeline.",
  "technicalDetails": "The root cause of the vulnerability is the absence of a length check when decoding input data into a fixed-size buffer within the KeePass AESKDF/KDBX v4 module (module 34301).\nSpecifically, the module accepts up to 600 hex characters for the ninth token field in the input hash structure.\nHowever, this input is decoded directly into a fixed 256-byte destination buffer without validating that the decoded data size fits within the allocated boundary.\nThis design flaw allows a maximal input payload to write up to 44 bytes past the target buffer boundary.\nThe out-of-bounds write overflows into adjacent esalt fields and heap chunk metadata structures residing on the heap.\nThe attack flow begins when hashcat processes a maliciously crafted input line or hash file containing an oversized ninth token field for module 34301.\nDuring the parsing and decoding phase, the vulnerable function copies the excessive decoded bytes into the fixed-size memory allocation.\nThe overflow overwrites adjacent heap metadata and sensitive esalt structures, inducing memory corruption.\nPost-exploitation impact includes memory access violations, application crashes, or potential disruption of the memory allocator's internal structures.\nThe vulnerability affects hashcat master branch builds after v7.1.2.\nAuthentication and privilege requirements depend on the execution context of the hashcat utility, typically requiring local execution or ingestion of untrusted hash files provided by a user."
}