Description

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-22T15:16:20.770Z",
  "pubdate": "2026-08-22T15:16:20.770Z",
  "executiveSummary": "An out-of-bounds heap write vulnerability exists in hashcat, specifically within the fgetl() function located in src/filehandling.c. The flaw manifests when the application processes an input line whose length matches the exact buffer size limit, designated as HCBUFSIZ_LARGE bytes. Under this specific condition, the function erroneously writes a null terminator one byte past the boundary of the caller-allocated buffer.\nThe vulnerability affects systems processing untrusted file inputs, including hash files, potfiles, and wordlists. Successful exploitation of this heap-based buffer overflow can lead to memory corruption, potentially causing application crashes, denial of service, or arbitrary code execution depending on the heap layout and memory structures surrounding the target buffer.\nAn attacker can trigger this vulnerability by supplying a maliciously crafted file containing a meticulously sized line matching the precise buffer capacity. No specialized authentication or high privilege levels are required locally, as the parsing routines process standard input files directly supplied by users during normal operational workflows.",
  "technicalDetails": "The vulnerability resides in the fgetl() function implemented in src/filehandling.c within hashcat. The vulnerable component is responsible for reading lines from various input sources such as wordlists, potfiles, and target hash lists into internal memory buffers.\nThe root cause of the issue is an off-by-one error during boundary checking and string termination. When the input line length equals HCBUFSIZ_LARGE bytes, the function attempts to append a null terminator to signify the end of the string. Instead of writing within the allocated bounds of the caller's buffer, the pointer arithmetic evaluates incorrectly, causing a single null byte to be written exactly one byte past the heap-allocated buffer's boundary.\nThe attack flow proceeds as follows: First, the user or operator instructs hashcat to load an external file, such as a wordlist or potfile, which has been crafted by an adversary. Second, hashcat invokes fgetl() to read lines from the file into memory. Third, when the parsing logic encounters a line containing precisely HCBUFSIZ_LARGE bytes, the internal read routine fills the buffer completely. Fourth, upon concluding the read operation for that specific line, the function attempts to null-terminate the string, executing an out-of-bounds heap write.\nExploitation requires the attacker to have control over or the ability to supply a malicious input file processed by hashcat. The vulnerability does not require network exposure or authentication since file handling operations execute locally with the privileges of the user running hashcat. Depending on the memory allocator state and the heap layout, overwriting the adjacent heap metadata or adjacent heap chunks can lead to destabilization of the memory manager, application crashes, or theoretical code execution scenarios."
}