EUVD-2026-74788
GHSA-5r36-v86r-vm5x
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parse DoS requires user to open a crafted file; impact is application crash only with no credential exposure, supporting A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
AnalysisAI
Memory exhaustion in KeePass 2.35 through 2.61.1 crashes the password manager when a user opens a crafted KDBX database file whose header fields declare excessive allocation lengths. The ReadHeaderField function performs no bounds validation before honoring attacker-controlled length values, enabling gigabyte-scale memory allocations that exhaust system RAM and terminate the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target user must manually open a crafted KDBX file within KeePass (UI:R per the CVSS vector) - exploitation cannot occur without this deliberate user action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.3 base score accurately reflects the constrained severity: the attack vector is local (AV:L), user interaction is required (UI:R), and impact is limited to application availability (A:L) with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update KeePass to a version beyond 2.61.1 by consulting the official download page at https://keepass.info/download.html and verifying the release resolves CVE-2026-86776 per the VulnCheck advisory at https://www.vulncheck.com/advisories/keepass-2.35-through-2.61.1-memory-exhaustion-via-kdbx-header-field-size; no specific patched version number is confirmed in available data so the fix version must be independently verified before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a work
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, whi
A flaw was found in keepass. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticati
KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file,
Share
External POC / Exploit Code
Leaving vuln.today