Read the docs
TI-2026-48350 Aliases CVE-2026-68768GHSA-cm34-rh84-36rf

hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username

Priority MEDIUM 64CWE-120Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hashcathashcatup to 7.1.2—No fix listedCNA
  • hashcat Vendorhashcat Affected up to 7.1.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68768
  2. 2026-10-03 Alias added: GHSA-cm34-rh84-36rf

References

Patch 1

Other 3

  • TI-2026-30768 A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2… CVSS 3.1CRITICAL 9.8
  • TI-2026-30767 A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an… CVSS 3.1CRITICAL 9.8
  • TI-2026-48348 hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection CVSS 4.0HIGH 8.5
  • TI-2026-30766 A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in… CVSS 3.1CRITICAL 9.8
  • TI-2026-48349 hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl() CVSS 4.0MEDIUM 6.9
  • TI-2026-48347 hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field CVSS 4.0MEDIUM 5.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences