EUVD-2026-64312
GHSA-vgv2-whp7-2895
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file delivery requires the user to run hashcat with attacker-supplied input (UI:R, AV:L); no privileges needed; heap corruption drives high availability impact with minimal integrity effect and no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.
AnalysisAI
Out-of-bounds heap write in hashcat's fgetl() function affects all versions through 7.1.2, triggered by supplying any input file - hash file, potfile, or wordlist - containing a line of exactly HCBUFSIZ_LARGE bytes, causing a one-byte null write past the caller's buffer. The resulting heap corruption can crash hashcat or, in a worst case, create memory exploitation primitives; confidentiality is unaffected (VC:N per the CVSS 4.0 vector) while availability impact is rated high. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user actively run hashcat and supply an attacker-controlled input file - a hash file, potfile, or wordlist - containing at least one line of exactly HCBUFSIZ_LARGE bytes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.9) correctly characterizes this as a local-vector, low-complexity flaw requiring passive user interaction with no special privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a wordlist or hash file containing a line padded to exactly HCBUFSIZ_LARGE bytes and delivers it to a hashcat user as a shared cracking resource or benchmark file. When the user runs hashcat against that file, fgetl() reads the oversized line and writes a null byte one position past the heap buffer boundary, corrupting adjacent heap metadata; depending on heap layout this causes an immediate crash or, in a more controlled scenario, allows overwriting a heap object to redirect execution. |
| Remediation | Update hashcat to a version incorporating patch commit 93b55d37d3b2340013d4036f10181ddc67d44249, available at https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Option injection in hashcat's restore file parser (all versions through 7.1.2) allows an attacker who delivers a crafted
Heap buffer overflow in hashcat through version 7.1.2 allows an attacker who controls a hash file to crash the process a
Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds a
Same weakness CWE-193 – Off-by-one Error
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today