CVE-2026-68768 PUBLISHED

hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username

Assigner: VulnCheck
Reserved: 31.07.2026 Published: 22.08.2026 Updated: 22.08.2026

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor hashcat
Product hashcat
Versions Default: unaffected
  • affected from 0 to 7.1.2 (incl.)

Credits

  • Piotr Kowalczyk finder

References

Problem Types

  • Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE