Read the docs
TI-2026-48349 Aliases CVE-2026-68767GHSA-vgv2-whp7-2895

hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()

Priority LOW 30CWE-193Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hashcathashcatup to 7.1.2—No fix listedCNA
  • hashcat Vendorhashcat Affected up to 7.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68767
  2. 2026-10-03 Alias added: GHSA-vgv2-whp7-2895

References

Patch 1

Other 3

  • TI-2026-30768 A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2… CVSS 3.1CRITICAL 9.8
  • TI-2026-30767 A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an… CVSS 3.1CRITICAL 9.8
  • TI-2026-48348 hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection CVSS 4.0HIGH 8.5
  • TI-2026-48350 hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username CVSS 4.0MEDIUM 6.9
  • TI-2026-30766 A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in… CVSS 3.1CRITICAL 9.8
  • TI-2026-48347 hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field CVSS 4.0MEDIUM 5.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences