hashcat CVE-2026-68767

Exploitation requires that a user actively run hashcat and supply an attacker-controlled input file - a hash file, potfile, or wordlist - containing at least one line of exactly HCBUFSIZ_LARGE bytes. No special hashcat configuration, elevated OS privileges, or authenticated session is required; the sole trigger condition is the precise line length in one of those three file types. The CVSS 4.0 UI:P metric confirms passive user interaction is required: the victim must execute hashcat with the malicious file. Limiting factors are: (1) the attacker must place or influence the content of an input file the victim processes; (2) hashcat's user base of security professionals typically controls their own wordlists and hash files, reducing exposure to adversary-supplied inputs; (3) the vulnerability does not trigger on lines shorter or longer than HCBUFSIZ_LARGE, requiring precise byte-length crafting. No network-facing or daemon-mode operation is involved.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) correctly characterizes this as a local-vector, low-complexity flaw requiring passive user interaction with no special privileges. VA:H reflects meaningful heap corruption risk, while VC:N and VI:L indicate the realistic ceiling is a crash rather than data disclosure. No EPSS data was included in the intelligence package, and this CVE does not appear in the CISA KEV catalog, meaning no confirmed or widespread active exploitation has been recorded. No POC is identified in the provided data. Real-world exploitation risk is further bounded by hashcat's user base: security practitioners who control their own input files are unlikely to process adversary-supplied wordlists or hash files. The primary plausible attack path requires social engineering. This is a legitimate memory-safety defect worth patching, but the combination of local attack vector, required user interaction, niche security-tool user base, and absence of KEV or EPSS signals places realistic exploitation probability low despite the moderate CVSS score.

An attacker crafts a wordlist or hash file containing a line padded to exactly HCBUFSIZ_LARGE bytes and delivers it to a hashcat user as a shared cracking resource or benchmark file. When the user runs hashcat against that file, fgetl() reads the oversized line and writes a null byte one position past the heap buffer boundary, corrupting adjacent heap metadata; depending on heap layout this causes an immediate crash or, in a more controlled scenario, allows overwriting a heap object to redirect execution.