hashcat CVE-2026-68765

Exploitation requires all of the following conditions simultaneously: local system access, high-privilege execution context (PR:H per CVSS 4.0 - the operator must have sufficient rights to run hashcat), and active user interaction (UI:A - a privileged user must explicitly invoke hashcat with the crafted input). The vulnerable code path is triggered only when hashcat processes a KeePass AESKDF/KDBX v4 hash file using module 34301 and the ninth token field of that hash contains more than 512 hex characters. Limiting factors are substantial: no remote or network-based exploitation path exists; the attacker must control the specific hash file fed to the hashcat process; and the operator must explicitly select module 34301. Organizations processing only internally generated or verified KeePass hash inputs are not meaningfully at risk.

The CVSS 4.0 score of 5.2 with vector AV:L/AC:L/AT:N/PR:H/UI:A accurately reflects a tightly constrained exploitability profile. Local attack vector, required high privileges, and mandatory active user interaction mean that exploitation is limited to scenarios where an attacker controls hash file input supplied to a privileged operator running hashcat. The primary impact is availability (VA:H - heap corruption causing crash or memory access violation), with only incidental integrity impact (VI:L - bounded out-of-bounds writes) and no confidentiality impact (VC:N). EPSS data was not provided and cannot be assessed; however, the absence of a CISA KEV listing and no identified public exploit code indicate no confirmed in-the-wild exploitation. The vulnerability is also gated behind a specific feature path (module 34301, KDBX v4 parsing), further reducing automated or opportunistic exploitation risk. Real-world priority is moderate for security teams operating hashcat in shared or adversarial input environments, but low for the broader threat landscape.

An attacker who controls a KeePass KDBX v4 hash file supplied to a privileged operator running a vulnerable hashcat build could craft the ninth token field with up to 600 hex characters, triggering a 44-byte out-of-bounds write into adjacent heap memory when module 34301 parses the input. Under a favorable heap layout, this corruption could destabilize hashcat's internal state, causing a crash (denial of service against an ongoing cracking session) or potentially enabling limited heap metadata manipulation. No public proof-of-concept code has been identified at time of analysis.