CVE-2026-68767: hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZLARGE bytes.
Affected Software
Event History
Frequently Asked Questions
Which files can introduce the vulnerable input?
Hash files, potfiles, and wordlists can trigger the issue if they contain a line exactly HCBUFSIZ_LARGE bytes long.
What must happen for exploitation to be possible?
An attacker must provide or cause hashcat to process one of the affected file types containing an exactly HCBUFSIZ_LARGE-byte line. The vulnerable fgetl() call must read that line.
How can teams reduce risk before updating?
Do not process untrusted hash files, potfiles, or wordlists without checking for lines exactly HCBUFSIZ_LARGE bytes long. Reject or modify such lines before supplying the files to hashcat.
What version range is identified as affected?
The issue is identified in hashcat through version 7.1.2.