Description

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-22T15:16:20.903Z",
  "pubdate": "2026-08-22T15:16:20.903Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability, specifically an out-of-bounds write, exists within the hashcat utility. The flaw resides in the outfile_write() function located in src/outfile.c. The vulnerability is triggered when the application assembles output data into a fixed-size buffer designated as HCBUFSIZ_LARGE, which has a capacity of approximately 16 megabytes. During this assembly process, the function sequentially appends components including the username, separator, hash, and plaintext using memcpy operations. The core security failing is the absence of bounds validation to ensure the accumulated length does not exceed the allocated buffer capacity.\nAn attacker can exploit this weakness by supplying a crafted hash file containing an oversized username specifically engineered to nearly fill the buffer. When hashcat is executed using parameters such as --username --show against this malicious input, the total assembled output exceeds the buffer limits. This results in a heap buffer overflow capable of corrupting adjacent memory structures and causing an immediate process crash. The risk implications include denial of service through application termination and potential memory corruption that could theoretically be leveraged for arbitrary code execution depending on heap layout and allocator behavior. Exploitation requires the victim to process a malicious input file with specific command-line arguments enabled.",
  "technicalDetails": "The vulnerability is rooted in inadequate input validation and unsafe memory manipulation functions within the hashcat codebase, specifically affecting the outfile_write() function in src/outfile.c. The vulnerable component is responsible for formatting and writing cracking results to an output file or stdout. To optimize I/O operations, the function utilizes a pre-allocated fixed-size buffer known as HCBUFSIZ_LARGE, sized at approximately 16 MB.\nThe step-by-step attack flow begins when an operator or automated system executes hashcat with specific command-line arguments, namely --username and --show, pointing to a specially crafted input file. Within this file, an attacker embeds an exceptionally large username designed to consume a significant portion of the HCBUFSIZ_LARGE buffer capacity.\nDuring execution, outfile_write() processes the results and begins constructing the output line. It sequentially appends the oversized username, the designated separator, the target hash, and the cracked plaintext into the fixed-size buffer. The implementation employs standard memcpy operations to concatenate these fields without verifying whether the cumulative size of the data exceeds the remaining capacity of the destination buffer.\nBecause the length calculations fail to account for the malicious dimensions of the oversized username, the sequence of memcpy operations writes past the boundary of the heap-allocated HCBUFSIZ_LARGE buffer. This out-of-bounds write introduces a heap-based buffer overflow, overwriting adjacent memory regions within the heap segment. Depending on the memory layout and the specific heap allocator implementation, this corruption leads directly to application instability and crashes due to segmentation faults or heap metadata corruption. The vulnerability does not require network exposure or authentication, as it is triggered locally by processing untrusted input files with specific operational flags."
}