CVE-2026-42484: Buffer Overflow
A heap-based buffer overflow in hextobinary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When datatypeenum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42484?
CVE-2026-42484 has a severity level that indicates a significant risk due to potential denial of service or arbitrary code execution.
How do I fix CVE-2026-42484?
To fix CVE-2026-42484, you should update Hashcat to version 7.2.0 or later, which addresses this vulnerability.
What versions of Hashcat are affected by CVE-2026-42484?
CVE-2026-42484 specifically affects Hashcat version 7.1.2.
What types of attacks can exploit CVE-2026-42484?
CVE-2026-42484 can be exploited through crafted PKZIP hash files leading to denial of service or arbitrary code execution.
Which modules in Hashcat are impacted by CVE-2026-42484?
CVE-2026-42484 affects the following modules: 17200, 17210, 17220, 17225, and 17230.