CVE-2026-68766: hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection
hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.
Affected Software
Event History
Frequently Asked Questions
What access or user interaction is required for exploitation?
An attacker must be able to provide or cause a user to use a crafted hashcat restore file. The user must then run hashcat with that restore file; the CVSS vector indicates local attack access and required user interaction, with no privileges required.
Who is most exposed to this issue?
Systems where users run hashcat using restore files obtained from untrusted sources are exposed. Impact is especially severe if hashcat runs under an account whose shell startup files or other execution-relevant files can be modified.
What can an attacker change through the crafted restore file?
Injected options such as --outfile and --potfile-path can redirect output and append attacker-controlled content to arbitrary files. Targeting shell startup files can turn that file write into code execution when the affected shell environment is started.
What can be done until an update is applied?
Do not use restore files from untrusted or unverifiable sources. Restrict hashcat execution to trusted restore files and avoid running it under accounts where writes to shell startup files or other sensitive files could lead to execution.