CVE-2026-118673

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118673", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-28T17:25:37.562Z", "datePublished": "2026-10-29T16:01:55.635Z", "dateUpdated": "2026-11-03T16:32:32.671Z"}, "containers": {"cna": {"title": "KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227"}, {"name": "https://github.com/keepassxreboot/keepassxc/pull/13679", "tags": ["x_refsource_MISC"], "url": "https://github.com/keepassxreboot/keepassxc/pull/13679"}, {"name": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa", "tags": ["x_refsource_MISC"], "url": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa"}, {"name": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0"}], "affected": [{"vendor": "keepassxreboot", "product": "keepassxc", "versions": [{"version": ">= 2.3.0, < 2.8.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T16:01:55.635Z"}, "descriptions": [{"lang": "en", "value": "KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0."}], "source": {"advisory": "GHSA-3448-gh8j-3227", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T16:30:40.960267Z", "id": "CVE-2026-118673", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:32:32.671Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118673", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T16:30:40.960267Z"}}}], "references": [{"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T16:32:17.637Z"}}], "cna": {"title": "KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses", "source": {"advisory": "GHSA-3448-gh8j-3227", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "keepassxreboot", "product": "keepassxc", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.8.0"}]}], "references": [{"url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227", "name": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/keepassxreboot/keepassxc/pull/13679", "name": "https://github.com/keepassxreboot/keepassxc/pull/13679", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa", "name": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0", "name": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-29T16:01:55.635Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118673", "state": "PUBLISHED", "dateUpdated": "2026-11-03T16:32:32.671Z", "dateReserved": "2026-10-28T17:25:37.562Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-29T16:01:55.635Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "keepassxc", "vendor": "keepassxreboot", "versions": [{"status": "affected", "version": ">= 2.3.0, < 2.8.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0."}], "id": "CVE-2026-118673", "lastModified": "2026-11-03T17:17:58.770", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118673", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T16:30:40.960267Z", "version": "2.0.3"}}]}, "published": "2026-10-29T16:18:03.873", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa"}, {"source": "security-advisories@github.com", "url": "https://github.com/keepassxreboot/keepassxc/pull/13679"}, {"source": "security-advisories@github.com", "url": "https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "keepassxc: KeePassXC: Denial of Service (DoS) via out-of-bounds write in browser integration", "id": "2563571", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563571"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.", "A flaw was found in KeePassXC. A local user with access to the inter-process communication (IPC) interface and an authorized database association can cause a Denial of Service (DoS) by crashing the application. By prompting an unlocked database to generate and encrypt an excessively large response through the browser integration component, the application triggers an out-of-bounds write beyond the allocated buffer, terminating the process."], "name": "CVE-2026-118673", "public_date": "2026-10-29T16:01:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118673\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118673\nhttps://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa\nhttps://github.com/keepassxreboot/keepassxc/pull/13679\nhttps://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0\nhttps://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires local access alongside multiple prerequisites, including an active and unlocked database session with an already-established browser pairing. Under these conditions, an attacker can only force the KeePassXC process to crash, resulting in a denial of service without compromising data confidentiality or system integrity. Furthermore, the browser integration feature must be actively enabled and configured by the user, limiting exposure in standard deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.0,2.8.0)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "keepassxc", "source": "cna", "vendor": "keepassxreboot"}, "product": "keepassxc", "vendor": "keepassxc"}], "created": "2026-10-29T17:30:14.525304+00:00", "updated": "2026-10-30T22:30:13.734248+00:00", "vendors": ["keepassxc", "keepassxc$PRODUCT$keepassxc"]}