KeePassXC EUVD-2026-98810

Exploitation requires a victim running KeePassXC prior to 2.8.0-beta1 to actively use the legacy KeePass1/KDB import feature on an attacker-supplied, crafted .kdb file that is unlockable and contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing that earlier entry's UUID. Limiting factors: the attack is local (AV:L) with no network path, needs active user interaction to perform the import (UI:A), targets a niche legacy KDB import code path that is not part of normal day-to-day use, and the file must be openable. Default usage of the product without importing a malicious legacy database is not affected.

The supplied CVSS 4.0 base score is 4.3 (Medium), and every signal points to genuinely low real-world urgency rather than a high-severity emergency. The vector (AV:L/AC:H/AT:P/PR:L/UI:A) means exploitation is local, high-complexity, carries an explicit attack requirement, and demands active user interaction - the victim must manually import an attacker-supplied legacy .kdb file. Impact is dominated by availability (VA:H, a reliable process crash) with only limited integrity impact (VI:L from the controlled heap write) and no confidentiality impact (VC:N). No EPSS score was provided, the CVE is not in CISA KEV, and no public PoC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One conflict to flag: the supplied vector states PR:L, but importing a database file requires no special application privileges - I assess this as effectively unauthenticated (PR:N); verify with the vendor advisory. Bottom line: this is primarily a social-engineering-dependent denial-of-service in a non-default legacy import path; the controlled write raises theoretical code-execution concerns but is not demonstrated, so this is a low-priority, patch-in-normal-cycle issue rather than an emergency.

An attacker crafts a malicious but openable KeePass1/.kdb file containing a metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier entry's UUID, then socially engineers a KeePassXC user (version prior to 2.8.0-beta1) into importing it via the legacy KDB import feature. During parsing, parseCustomIcons4() calls Entry::setIcon through a stale pointer left in m_entryUuids, triggering a heap use-after-free with a controlled write that reliably crashes the application. No public exploit code is known to exist, and the local attack vector plus required active user interaction make this a targeted, low-likelihood scenario.