Source: hashcat Version: 7.1.2+ds1-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for hashcat. CVE-2026-68766[0]: | hashcat fails to restrict command-line options when parsing restore | files, allowing attackers to inject output-redirecting options like | --outfile and --potfile-path. Attackers can craft restore files with | malicious options to append attacker-controlled content to arbitrary | files, enabling code execution when targeting shell startup files. CVE-2026-68767[1]: | hashcat's fgetl() function in src/filehandling.c writes a null | terminator one byte past the caller's buffer when an input line is | exactly the buffer length. Attackers can trigger this out-of-bounds | heap write by providing a hash file, potfile, or wordlist containing | a line of exactly HCBUFSIZ_LARGE bytes. CVE-2026-68768[2]: | hashcat contains a heap-based buffer overflow (out-of-bounds write) | in the outfile_write() function in src/outfile.c. When assembling | output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the | function sequentially appends the username, separator, hash, and | plaintext via memcpy without validating that the accumulated length | stays within the buffer capacity. When run with --username --show | against a crafted hash file containing an oversized username that | nearly fills the buffer, the total assembled output exceeds the | buffer, causing a heap buffer overflow that can corrupt memory and | crash the process. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-68766 https://www.cve.org/CVERecord?id=CVE-2026-68766 [1] https://security-tracker.debian.org/tracker/CVE-2026-68767 https://www.cve.org/CVERecord?id=CVE-2026-68767 [2] https://security-tracker.debian.org/tracker/CVE-2026-68768 https://www.cve.org/CVERecord?id=CVE-2026-68768 Regards, Salvatore
