{"id":"CVE-2026-68768","aliases":["DEBIAN-CVE-2026-68768","EUVD-2026-64313","GHSA-cm34-rh84-36rf","UBUNTU-CVE-2026-68768","openSUSE-SU-2026:12181-1","openSUSE-SU-2026:22138-1"],"status":"published","title":"hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00209,"percentile":0.11129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2026-08-22T14:12:44Z","modified":"2026-10-28T11:17:18Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds1-1","6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Debian:13","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Debian:14","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-1","7.1.2+ds1-2","7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.60-1","4.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.0+ds1-1","5.1.0+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+ds1-1","6.2.5+ds1-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds1-1","6.2.6+ds1-1build1","6.2.6+ds1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.2+ds1-3","7.1.2+ds1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.6+ds2-1","7.1.2+ds1-3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+git942-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"hashcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+git942-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"hashcat","product":"hashcat"}],"references":[{"url":"https://github.com/hashcat/hashcat/issues/4740","tags":["issue-tracking","exploit","report"]},{"url":"https://github.com/hashcat/hashcat","tags":["product","package"]},{"url":"https://github.com/hashcat/hashcat/commit/68f56a2d8712867a8520bf4dcf07f6145c23df89","tags":["patch","fix"]},{"url":"https://github.com/hashcat/hashcat/blob/v7.1.2/src/outfile.c#L654-L668","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/hashcat-through-heap-buffer-overflow-in-outfile-write-via-oversized-username","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68768","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cm34-rh84-36rf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68768.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-68768","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-68768","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68768","tags":["report"]},{"url":"https://github.com/hashcat/hashcat/pull/4754","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68768","tags":["web"]},{"url":"https://bugzilla.suse.com/1248352","tags":["report"]},{"url":"https://bugzilla.suse.com/1276254","tags":["report"]},{"url":"https://bugzilla.suse.com/1276255","tags":["report"]},{"url":"https://bugzilla.suse.com/1276256","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68766","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-68768","title":"hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T14:12:44.241Z","modified":"2026-08-24T18:31:59.841Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-64313","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T14:12:44Z","modified":"2026-08-24T18:31:59Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:34.230875Z"}],"ghsa":[{"id":"GHSA-cm34-rh84-36rf","title":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write()...","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T15:31:04Z","modified":"2026-08-22T15:31:04Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:10:50.919771Z"}],"nvd":[{"id":"CVE-2026-68768","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T15:16:20.903Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-68768","title":"hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T14:12:44.241Z","modified":"2026-10-28T11:17:18.271320439Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"DEBIAN-CVE-2026-68768","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T15:16:20.903Z","modified":"2026-10-15T09:47:42.359047116Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"UBUNTU-CVE-2026-68768","description":"hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.","status":"published","published":"2026-08-22T15:16:00Z","modified":"2026-10-17T12:59:23.62894585Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"openSUSE-SU-2026:12181-1","title":"hashcat-7.1.2+git942-1.1 on GA media","description":"These are all security issues fixed in the hashcat-7.1.2+git942-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:05.151213545Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22138-1","title":"Security update for hashcat","description":"This update for hashcat fixes the following issues:\n\nChanges in hashcat:\n\nUpdate to snapshot v7.1.2-942-gef3508ed8:\n\n  * Addressed CVE-2026-68768 [boo#1276256],\n    CVE-2026-68767 [boo#1276255], CVE-2026-68766 [boo#1276254]\n  * Feed plugins and attack-mode 8\n  * Probability-ordered PCFG and targeted hints in attack-mode 4\n  * Device-accelerated table attacks in attack-mode 5\n  * Wordlists inside masks with attack-mode 12\n  * Account-aware association in attack-mode 9\n  * Seekable wordlists and one cache location\n  * A brain server built for large sessions\n  * Rules in every attack-mode\n  * A Python bridge that uses every CPU thread\n\nUpdate to release 7.1.2:\n\n  * New algorithms: AS/400 DES, AS/400 SHA1, Cisco-ISE SHA256,\n    LUKS2-Argon2i KDF, KeePass KDBX v4, SAP CODVN H SHA512,\n    sm3crypt, BLAKE2b-256, MD6, sha224\n\n- Use BUILD_MODE=cross to not optimize for build machine CPU (boo#1248352)\n\nUpdate to release 7.0.0:\n\n  * Full release notes at\n    /usr/share/doc/packages/hashcat/docs/releases_notes_v7.0.0.md\n  * Assimilation Bridge: Integrate external resources like CPUs,\n    FPGAs, embedded interpreters, and more into the cracking\n    pipeline.\n  * Python Bridge Plugin: Rapidly implement hash-matching logic in\n    Python. No recompilation needed, supports multithreading and\n    rule engine by default.\n  * Virtual Backend Devices: Internally partitions physical GPUs\n    into multiple logical devices for better bridge integration and\n    async workloads.\n  * Hash-Mode Autodetection: Omit the -m flag and let Hashcat\n    detect the hash-mode, or use --identify to list possibilities.\n  * 58 new application-specific hash types, including Argon2,\n    MetaMask, Microsoft Online Account, SNMPv3, GPG, OpenSSH, and\n    LUKS2\n  * 17 new generic hash constructions used in real-world web apps\n    and protocols\n  * 11 new primitives added to the crypto library, improving reuse\n    and plugin development\n  * 20 new tools to extract hashes from popular sources, including\n    APFS, Virtualbox, BitLocker, and various wallet formats\n  * Complete refactor of the autotuning engine for better device\n    utilization\n  * Major rewrite of memory management to eliminate previous 4GB\n    allocation caps and enable full memory usage across devices\n","status":"published","published":"2026-10-19T16:30:34Z","modified":"2026-10-20T19:15:03.938845272Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}