KeePassXC’s browser integration performs encryption using a fixed 1 MiB buffer while Botan::Sodium::crypto_box_easy writes a longer plaintext plus MAC. An attacker who controls a browser-Prot client with access to the IPC endpoint, an unlocked database, and can generate a sufficiently large authorized response can trigger a sequential out‑of‑bounds write before the response is delivered, corrupting memory. The CVSS score of 4.1 indicates moderate severity; the vulnerability does not explicitly claim remote code execution but allows memory corruption that could be leveraged in a contextual exploitation chain.

KeePassXC versions 2.3.0 through 2.8.0 deployed by keepassxreboot are affected. The issue was fixed in the 2.8.0 release; versions prior to that remain vulnerable.

The flaw requires local or privileged access to the IPC endpoint and an unlocked KeePassXC database. With those prerequisites it can lead to memory corruption. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited proof‑of‑concept exploitation so far and a moderate attack surface. Attackers with local control can potentially exploit the buffer overflow to corrupt memory, but no confirmed remote exploitation or advanced persistence is described.