CVE-2026-68767

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68767", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-31T16:10:55.447Z", "datePublished": "2026-08-22T14:12:43.477Z", "dateUpdated": "2026-08-26T16:16:18.796Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-22T14:12:43.477Z"}, "datePublic": "2026-07-31T00:00:00.000Z", "title": "hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()", "descriptions": [{"lang": "en", "value": "hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Off-by-one Error", "cweId": "CWE-193", "type": "CWE"}]}], "affected": [{"vendor": "hashcat", "product": "hashcat", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "7.1.2", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hashcat:hashcat:*:*:*:*:*:*:*:*", "versionEndIncluding": "7.1.2"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/hashcat/hashcat/issues/4739", "tags": ["issue-tracking"], "name": "GitHub Issue #4739"}, {"url": "https://github.com/hashcat/hashcat", "tags": ["product"]}, {"url": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249", "tags": ["patch"]}, {"url": "https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl"}], "credits": [{"lang": "en", "value": "Piotr Kowalczyk", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T15:55:33.117805Z", "id": "CVE-2026-68767", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T16:16:18.796Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68767", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T15:55:33.117805Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T15:55:34.240Z"}}], "cna": {"title": "hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()", "credits": [{"lang": "en", "type": "finder", "value": "Piotr Kowalczyk"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "hashcat", "product": "hashcat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.1.2"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-31T00:00:00.000Z", "references": [{"url": "https://github.com/hashcat/hashcat/issues/4739", "name": "GitHub Issue #4739", "tags": ["issue-tracking"]}, {"url": "https://github.com/hashcat/hashcat", "tags": ["product"]}, {"url": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249", "tags": ["patch"]}, {"url": "https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl", "name": "VulnCheck Advisory: hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "Off-by-one Error"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hashcat:hashcat:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "7.1.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-22T14:12:43.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68767", "state": "PUBLISHED", "dateUpdated": "2026-08-26T16:16:18.796Z", "dateReserved": "2026-07-31T16:10:55.447Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-22T14:12:43.477Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "hashcat", "vendor": "hashcat", "versions": [{"lessThanOrEqual": "7.1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes."}, {"lang": "es", "value": "La funci\u00f3n fgetl() de hashcat en src/filehandling.c escribe un terminador nulo un byte m\u00e1s all\u00e1 del b\u00fafer del llamador cuando una l\u00ednea de entrada tiene exactamente la longitud del b\u00fafer. Los atacantes pueden desencadenar esta escritura fuera de l\u00edmites en el heap al proporcionar un archivo de hash, un potfile o una lista de palabras que contenga una l\u00ednea de exactamente HCBUFSIZ_LARGE bytes."}], "id": "CVE-2026-68767", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68767", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-26T15:55:33.117805Z", "version": "2.0.3"}}]}, "published": "2026-08-22T15:16:20.770", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/hashcat/hashcat"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hashcat/hashcat/issues/4739"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-193"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.1.2]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "hashcat", "source": "cna", "vendor": "hashcat"}, "product": "hashcat", "vendor": "hashcat"}], "created": "2026-08-22T15:45:03.936781+00:00", "updated": "2026-08-22T16:00:13.525837+00:00", "vendors": ["hashcat", "hashcat$PRODUCT$hashcat"]}