CVE-2026-68768: hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfilewrite() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZLARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when an operator runs hashcat locally with --username --show against a crafted hash file. The triggering input is an oversized username that nearly fills the approximately 16 MB output buffer.
What must an attacker control or cause for exploitation?
The attacker needs a crafted hash file containing the oversized username and must cause a user to process it with --username --show. The vector is local and requires user interaction; no privileges are required.
Is ordinary hashcat use affected?
The described trigger specifically requires the --username and --show options. The provided information does not establish impact for other invocation modes.
What can be done before updating?
Avoid running --username --show on untrusted hash files, especially files that may contain exceptionally long usernames. Treat a crash during this operation as a potential indication that the vulnerable output-assembly path was reached.