EUVD-2026-21645Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged code execution
-
ExploitPlace malicious OpenSSL config
-
ExecutionKeePassXC loads unsecured configuration
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Attacker requires low-privilege local code execution on the target system. KeePassXC loads OpenSSL configuration from an unsecured directory in the search path. Victim interaction required: the user must run KeePassXC while the attacker's malicious OpenSSL configuration file is present in a readable path location. |
| Impact | CVSS 7.3 reflects local privilege escalation with high impact across confidentiality, integrity, and availability. Requires prior code execution and user interaction, limiting immediate blast radius. Affects KeePassXC password manager users; successful exploitation grants full application context access. Priority depends on deployment density in target environments. |
| Exploit ScenarioDerived | Attacker with local code execution plants malicious OpenSSL config in unsecured search path. When victim launches KeePassXC, application loads attacker-controlled config, executing arbitrary code with user privileges. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 11, 2026
Local privilege escalation in KeePassXC password manager allows authenticated attackers with low privileges to execute arbitrary code by exploiting insecure OpenSSL configuration file loading. When a target user launches KeePassXC, malicious configuration planted in an unsecured path is loaded, enabling code execution in KeePassXC's security context. Attack requires user interaction and prior low-privileged access. CVSS 7.3 (AV:L/AC:L/PR:L/UI:R). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch available per GitHub security advisory GHSA-4gr2-cr97-q9fx at https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4gr2-cr97-q9fx. Users should immediately upgrade to latest patched KeePassXC release identified in advisory. Until patching, mitigate by restricting write permissions on OpenSSL configuration search paths, running KeePassXC under least-privilege accounts, and avoiding execution from untrusted directories. Organizations should audit file system permissions on multi-user systems where KeePassXC is deployed. Monitor vendor advisory and ZDI-26-215 at https://www.zerodayinitiative.com/advisories/ZDI-26-215/ for technical details and coordinated disclosure timeline.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-427 uncontrolled search path element in OpenSSL configuration loading. KeePassXC reads OpenSSL config from attacker-writable locations before secure paths, allowing DLL hijacking or configuration injection. Affects cpe:2.3:a:keepassxc:keepassxc, requiring local file system access and social engineering to trigger execution.
Know when Keepassxc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of KeePassXC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of OpenSSL. The product loads configuration from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of KeePassXC when run by a target user on the system. Was ZDI-CAN-29156.
Executive ViewAI
CVE-2026-4158 is a local privilege escalation vulnerability in KeePassXC that allows low-privileged users to execute arbitrary code with the privileges of whoever launches the application, potentially compromising stored credentials and sensitive data managed within KeePassXC. Organizations using KeePassXC for credential management face risk of password vault compromise if users with limited system access can place malicious configuration files on shared systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict KeePassXC installation and execution to trusted administrative users only; (2) Implement strict file system ACLs on KeePassXC configuration paths (~/.config/KeePassXC/ on Linux, %APPDATA%\KeePassXC on Windows) to prevent write access by low-privileged accounts; (3) Disable KeePassXC auto-launch features; (4) Monitor configuration file integrity using file integrity monitoring tools; (5) Educate users to launch KeePassXC only from trusted locations and avoid systems shared with untrusted low-privileged accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in t
KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master passwo
A heap use-after-free in KeePassXC's legacy KeePass1/KDB import path can crash the application and permit a limited, att
Out-of-bounds heap write in KeePassXC's browser integration (versions 2.3.0 through 2.7.12) lets a local client that alr
Exploit-DB