CVE-2026-69150: KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in mentryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPXCUSTOMICONS4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KeePassXCto a version that resolves this vulnerability.Fixed in 2.8.0-beta1
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must provide a crafted, unlockable KeePass1 .kdb file. It must contain an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier entry’s UUID.
What is the likely impact when the malicious database is imported?
Importing the crafted file can cause a reliable KeePassXC process crash. The stale Entry pointer is used for a controlled write, resulting in a heap use-after-free.
Which installations need to be updated?
KeePassXC versions prior to 2.8.0-beta1 are affected. The issue is fixed in 2.8.0-beta1.
What can be done if updating is not immediately possible?
Do not import untrusted or unexpected KeePass1/KDB database files until the application can be updated. The described trigger occurs during import of a specially structured, unlockable .kdb file.