CVE-2026-118673: KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::cryptoboxeasy() writes the plaintext length plus cryptoboxMACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KeePassXCto a version that resolves this vulnerability.Fixed in 2.8.0
Event History
Frequently Asked Questions
Which KeePassXC installations are exposed?
KeePassXC versions from 2.3.0 up to, but not including, 2.8.0 are affected when browser integration is used. The issue is fixed in version 2.8.0.
What access does an attacker need to trigger the out-of-bounds write?
The attacker needs to act as a browser-protocol client with access to the per-user IPC endpoint and a valid database association. They must also cause an unlocked database to generate an authorized response large enough to exceed the fixed output buffer.
Does the issue affect a locked database or occur before a browser response is sent?
The vulnerable path requires the database to be unlocked. The sequential out-of-bounds write occurs during encryption, before any response is delivered to the browser-protocol client.