Hashcat
Monthly
Heap buffer overflow in hashcat through version 7.1.2 allows an attacker who controls a hash file to crash the process and corrupt heap memory when an operator runs hashcat with the --username --show flags. The outfile_write() function in src/outfile.c sequentially appends username, separator, hash, and plaintext into a fixed ~16 MB heap buffer (HCBUFSIZ_LARGE) via memcpy without tracking accumulated length against buffer capacity, enabling an out-of-bounds write. No active exploitation has been confirmed (not in CISA KEV), and a vendor patch has been released via upstream commit.
Out-of-bounds heap write in hashcat's fgetl() function affects all versions through 7.1.2, triggered by supplying any input file - hash file, potfile, or wordlist - containing a line of exactly HCBUFSIZ_LARGE bytes, causing a one-byte null write past the caller's buffer. The resulting heap corruption can crash hashcat or, in a worst case, create memory exploitation primitives; confidentiality is unaffected (VC:N per the CVSS 4.0 vector) while availability impact is rated high. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch commit is available.
Option injection in hashcat's restore file parser (all versions through 7.1.2) allows an attacker who delivers a crafted restore file to append attacker-controlled content to arbitrary files on the victim's system. When a user runs 'hashcat --restore' against the malicious file, output-redirecting options such as --outfile and --potfile-path are accepted from the restore file without restriction, enabling writes to shell startup scripts and subsequent code execution at the victim's privilege level. No public exploit identified at time of analysis; CVSS 4.0 rates this 8.5 with a strictly local attack vector and user interaction required.
Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds after v7.1.2 to heap memory corruption when a privileged operator processes a crafted hash file containing an oversized ninth token field. The parser accepted up to 600 hex characters for a field decoded into a fixed 256-byte buffer with no length check, enabling up to 44 bytes of out-of-bounds writes into adjacent esalt fields and heap chunk metadata. No public exploit exists and the vulnerability is not listed in CISA KEV; an upstream fix commit is confirmed available.
Heap buffer overflow in hashcat through version 7.1.2 allows an attacker who controls a hash file to crash the process and corrupt heap memory when an operator runs hashcat with the --username --show flags. The outfile_write() function in src/outfile.c sequentially appends username, separator, hash, and plaintext into a fixed ~16 MB heap buffer (HCBUFSIZ_LARGE) via memcpy without tracking accumulated length against buffer capacity, enabling an out-of-bounds write. No active exploitation has been confirmed (not in CISA KEV), and a vendor patch has been released via upstream commit.
Out-of-bounds heap write in hashcat's fgetl() function affects all versions through 7.1.2, triggered by supplying any input file - hash file, potfile, or wordlist - containing a line of exactly HCBUFSIZ_LARGE bytes, causing a one-byte null write past the caller's buffer. The resulting heap corruption can crash hashcat or, in a worst case, create memory exploitation primitives; confidentiality is unaffected (VC:N per the CVSS 4.0 vector) while availability impact is rated high. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch commit is available.
Option injection in hashcat's restore file parser (all versions through 7.1.2) allows an attacker who delivers a crafted restore file to append attacker-controlled content to arbitrary files on the victim's system. When a user runs 'hashcat --restore' against the malicious file, output-redirecting options such as --outfile and --potfile-path are accepted from the restore file without restriction, enabling writes to shell startup scripts and subsequent code execution at the victim's privilege level. No public exploit identified at time of analysis; CVSS 4.0 rates this 8.5 with a strictly local attack vector and user interaction required.
Heap buffer overflow in hashcat's KeePass AESKDF/KDBX v4 cracking module (module_34301.c) exposes master branch builds after v7.1.2 to heap memory corruption when a privileged operator processes a crafted hash file containing an oversized ninth token field. The parser accepted up to 600 hex characters for a field decoded into a fixed 256-byte buffer with no length check, enabling up to 44 bytes of out-of-bounds writes into adjacent esalt fields and heap chunk metadata. No public exploit exists and the vulnerability is not listed in CISA KEV; an upstream fix commit is confirmed available.