KeePass CVE-2026-86776

The target user must manually open a crafted KDBX file within KeePass (UI:R per the CVSS vector) - exploitation cannot occur without this deliberate user action. The attack vector is local (AV:L), meaning the malicious file must reach the victim's filesystem, typically via social engineering such as phishing or file substitution of a legitimate database. No elevated system privileges are required of the attacker (PR:N). The vulnerability triggers in the default KeePass file-open code path with no special features or non-default configuration needed. Exploitation is bounded to the KeePass process itself: the operating system is not compromised, and stored credential data is not exposed during the crash - impact ends when the application terminates.

The CVSS 3.3 base score accurately reflects the constrained severity: the attack vector is local (AV:L), user interaction is required (UI:R), and impact is limited to application availability (A:L) with no confidentiality or integrity consequences. Despite the publicly available proof-of-concept hosted at GitHub, the exploitation chain is not automatable - an attacker must socially engineer a target into opening a crafted file, which materially limits realistic threat scale. SSVC framing: exploitation status is proof-of-concept only (not active), the technique is not automatable at scale, and technical impact is partial (application crash, not system compromise). In practice, even a mid-sized municipal IT team in gliwice that runs KeePass as its standard enterprise credential store would face temporary lockout from the password database rather than any credential exfiltration - a meaningful but non-critical disruption. The absence of a CISA KEV entry and the DoS-only impact profile place this squarely in scheduled patching rather than emergency response territory.

An attacker crafts a KDBX file with header field length values set to multi-gigabyte figures and delivers it to a target via phishing email or by substituting a legitimate database backup on shared storage. When the victim opens the file in KeePass 2.35-2.61.1, ReadHeaderField allocates the declared memory without validation, rapidly exhausting available RAM and crashing the application. A public proof-of-concept demonstrating this technique is available at https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC.