{"id":"CVE-2026-68767","aliases":["DEBIAN-CVE-2026-68767","EUVD-2026-64312","GHSA-vgv2-whp7-2895","UBUNTU-CVE-2026-68767","openSUSE-SU-2026:12181-1","openSUSE-SU-2026:22138-1"],"status":"published","title":"hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00172,"percentile":0.06656,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-193"],"published":"2026-08-22T14:12:43Z","modified":"2026-10-28T11:01:24Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds1-1","6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Debian:13","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.60-1","4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0+ds1-1","5.1.0+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+ds1-1","6.2.5+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds1-1","6.2.6+ds1-1build1","6.2.6+ds1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+git942-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+git942-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"hashcat","product":"hashcat"}],"references":[{"url":"https://github.com/hashcat/hashcat/issues/4739","tags":["issue-tracking","report"]},{"url":"https://github.com/hashcat/hashcat","tags":["product","package"]},{"url":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","tags":["patch","fix"]},{"url":"https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68767","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vgv2-whp7-2895"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68767.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68767","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68767","tags":["report"]},{"url":"https://github.com/hashcat/hashcat/pull/4750","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68768","tags":["web"]},{"url":"https://bugzilla.suse.com/1248352","tags":["report"]},{"url":"https://bugzilla.suse.com/1276254","tags":["report"]},{"url":"https://bugzilla.suse.com/1276255","tags":["report"]},{"url":"https://bugzilla.suse.com/1276256","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68766","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-68767","title":"hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T14:12:43.477Z","modified":"2026-08-26T16:16:18.796Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-64312","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T14:12:43Z","modified":"2026-08-26T16:16:18Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:30.542287Z"}],"ghsa":[{"id":"GHSA-vgv2-whp7-2895","title":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the...","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T15:31:04Z","modified":"2026-08-22T15:31:04Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:10:50.919771Z"}],"nvd":[{"id":"CVE-2026-68767","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T15:16:20.77Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-68767","title":"hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T14:12:43.477Z","modified":"2026-10-28T11:01:24.979296837Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"DEBIAN-CVE-2026-68767","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T15:16:20.77Z","modified":"2026-10-15T09:47:40.649661295Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-68767","description":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","status":"published","published":"2026-08-22T15:16:00Z","modified":"2026-10-17T12:59:24.784305559Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"openSUSE-SU-2026:12181-1","title":"hashcat-7.1.2+git942-1.1 on GA media","description":"These are all security issues fixed in the hashcat-7.1.2+git942-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:05.151213545Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22138-1","title":"Security update for hashcat","description":"This update for hashcat fixes the following issues:\n\nChanges in hashcat:\n\nUpdate to snapshot v7.1.2-942-gef3508ed8:\n\n  * Addressed CVE-2026-68768 [boo#1276256],\n    CVE-2026-68767 [boo#1276255], CVE-2026-68766 [boo#1276254]\n  * Feed plugins and attack-mode 8\n  * Probability-ordered PCFG and targeted hints in attack-mode 4\n  * Device-accelerated table attacks in attack-mode 5\n  * Wordlists inside masks with attack-mode 12\n  * Account-aware association in attack-mode 9\n  * Seekable wordlists and one cache location\n  * A brain server built for large sessions\n  * Rules in every attack-mode\n  * A Python bridge that uses every CPU thread\n\nUpdate to release 7.1.2:\n\n  * New algorithms: AS/400 DES, AS/400 SHA1, Cisco-ISE SHA256,\n    LUKS2-Argon2i KDF, KeePass KDBX v4, SAP CODVN H SHA512,\n    sm3crypt, BLAKE2b-256, MD6, sha224\n\n- Use BUILD_MODE=cross to not optimize for build machine CPU (boo#1248352)\n\nUpdate to release 7.0.0:\n\n  * Full release notes at\n    /usr/share/doc/packages/hashcat/docs/releases_notes_v7.0.0.md\n  * Assimilation Bridge: Integrate external resources like CPUs,\n    FPGAs, embedded interpreters, and more into the cracking\n    pipeline.\n  * Python Bridge Plugin: Rapidly implement hash-matching logic in\n    Python. No recompilation needed, supports multithreading and\n    rule engine by default.\n  * Virtual Backend Devices: Internally partitions physical GPUs\n    into multiple logical devices for better bridge integration and\n    async workloads.\n  * Hash-Mode Autodetection: Omit the -m flag and let Hashcat\n    detect the hash-mode, or use --identify to list possibilities.\n  * 58 new application-specific hash types, including Argon2,\n    MetaMask, Microsoft Online Account, SNMPv3, GPG, OpenSSH, and\n    LUKS2\n  * 17 new generic hash constructions used in real-world web apps\n    and protocols\n  * 11 new primitives added to the crypto library, improving reuse\n    and plugin development\n  * 20 new tools to extract hashes from popular sources, including\n    APFS, Virtualbox, BitLocker, and various wallet formats\n  * Complete refactor of the autotuning engine for better device\n    utilization\n  * Major rewrite of memory management to eliminate previous 4GB\n    allocation caps and enable full memory usage across devices\n","status":"published","published":"2026-10-19T16:30:34Z","modified":"2026-10-20T19:15:03.938845272Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}