Keepassxc
Monthly
Local privilege escalation in KeePassXC password manager allows authenticated attackers with low privileges to execute arbitrary code by exploiting insecure OpenSSL configuration file loading. When a target user launches KeePassXC, malicious configuration planted in an unsecured path is loaded, enabling code execution in KeePassXC's security context. Attack requires user interaction and prior low-privileged access. CVSS 7.3 (AV:L/AC:L/PR:L/UI:R). No public exploit identified at time of analysis.
Out-of-bounds heap write in KeePassXC's browser integration (versions 2.3.0 through 2.7.12) lets a local client that already holds a valid database association key crash the KeePassXC process while a database is unlocked, producing a reliable denial of service. The flaw is a fixed 1 MiB ciphertext buffer in BrowserMessageBuilder.cpp that is not resized or rejected when Botan's crypto_box_easy() must write plaintext length plus 16 MAC bytes, so a sufficiently large authorized response (reproduced with roughly 180 matching entries carrying ~8 KiB titles, crossing over near 8,161-character titles) writes sequentially past the buffer. The reporter reproduced a deterministic 0xC0000005 access violation inside botan-3.dll under Microsoft CDB using the official 2.7.12 Windows build, so a public proof-of-concept reproduction exists; it is not verified as weaponized exploit code beyond a crash, there is no CISA KEV entry, and impact is assessed as availability-only (CVSS 4.0 base 4.1, MEDIUM; independent vector AV:L/AC:H/PR:L/UI:R with C:N/I:N/A:H). The overflow is built only after entries are authorized, so the default AlwaysAllowAccess=false policy requires interactive user approval and the process survives if approval is withheld.
A heap use-after-free in KeePassXC's legacy KeePass1/KDB import path can crash the application and permit a limited, attacker-influenced write when a user actively imports a crafted, unlockable .kdb file; all builds prior to 2.8.0-beta1 are affected. The flaw is local-only and requires the victim to manually run the legacy import against an attacker-supplied database, so normal day-to-day use of KeePassXC without importing untrusted KDB files is not exposed. Severity is modest - CVSS 4.0 base 4.3 (Medium) and an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (impact skewed to availability, with only low integrity impact and no confidentiality loss) - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database via a memory dump. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Local privilege escalation in KeePassXC password manager allows authenticated attackers with low privileges to execute arbitrary code by exploiting insecure OpenSSL configuration file loading. When a target user launches KeePassXC, malicious configuration planted in an unsecured path is loaded, enabling code execution in KeePassXC's security context. Attack requires user interaction and prior low-privileged access. CVSS 7.3 (AV:L/AC:L/PR:L/UI:R). No public exploit identified at time of analysis.
Out-of-bounds heap write in KeePassXC's browser integration (versions 2.3.0 through 2.7.12) lets a local client that already holds a valid database association key crash the KeePassXC process while a database is unlocked, producing a reliable denial of service. The flaw is a fixed 1 MiB ciphertext buffer in BrowserMessageBuilder.cpp that is not resized or rejected when Botan's crypto_box_easy() must write plaintext length plus 16 MAC bytes, so a sufficiently large authorized response (reproduced with roughly 180 matching entries carrying ~8 KiB titles, crossing over near 8,161-character titles) writes sequentially past the buffer. The reporter reproduced a deterministic 0xC0000005 access violation inside botan-3.dll under Microsoft CDB using the official 2.7.12 Windows build, so a public proof-of-concept reproduction exists; it is not verified as weaponized exploit code beyond a crash, there is no CISA KEV entry, and impact is assessed as availability-only (CVSS 4.0 base 4.1, MEDIUM; independent vector AV:L/AC:H/PR:L/UI:R with C:N/I:N/A:H). The overflow is built only after entries are authorized, so the default AlwaysAllowAccess=false policy requires interactive user approval and the process survives if approval is withheld.
A heap use-after-free in KeePassXC's legacy KeePass1/KDB import path can crash the application and permit a limited, attacker-influenced write when a user actively imports a crafted, unlockable .kdb file; all builds prior to 2.8.0-beta1 are affected. The flaw is local-only and requires the victim to manually run the legacy import against an attacker-supplied database, so normal day-to-day use of KeePassXC without importing untrusted KDB files is not exposed. Severity is modest - CVSS 4.0 base 4.3 (Medium) and an assessed CVSS 3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H (impact skewed to availability, with only low integrity impact and no confidentiality loss) - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database via a memory dump. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.