Read the docs
TI-2026-48348 Aliases CVE-2026-68766GHSA-5qq7-x27p-hfq4

hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection

Priority HIGH 76CWE-88Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00235 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hashcathashcatup to 7.1.2—No fix listedCNA
  • hashcat Vendorhashcat Affected up to 7.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68766
  2. 2026-10-03 Alias added: GHSA-5qq7-x27p-hfq4

References

Patch 1

Other 3

  • TI-2026-30768 A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2… CVSS 3.1CRITICAL 9.8
  • TI-2026-30767 A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an… CVSS 3.1CRITICAL 9.8
  • TI-2026-48350 hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username CVSS 4.0MEDIUM 6.9
  • TI-2026-30766 A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in… CVSS 3.1CRITICAL 9.8
  • TI-2026-48349 hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl() CVSS 4.0MEDIUM 6.9
  • TI-2026-48347 hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field CVSS 4.0MEDIUM 5.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences