A stack-based buffer overflow exists in the hex‑mangle functions of hashcat, allowing an attacker to crash the program or, possibly, execute arbitrary code by supplying a specially crafted rule file or using the -j or -k options with password candidates of 128 or more characters. The flaw is caused by a bounds check that does not account for the two‑times expansion of password bytes when converted to hexadecimal.

hashcat version 7.1.2 is affected. The issue was identified in the source functions used during rule application, so any environment deploying that specific version and using the rule options described may be vulnerable. No other product or version data was provided in the advisory.

The CVSS score is 7.5, the EPSS score is not available, so the likelihood of exploitation is unclear from the data. However, because the vulnerability can be triggered by a crafted rule file or certain command options, environments that routinely run hashcat with user‑supplied rules or long password candidates face a definite risk. The vulnerability is not currently in the CISA KEV catalog, but the potential for arbitrary code execution means it deserves prompt attention.