The vulnerability is a heap‑based buffer overflow in the hex_to_binary routine used by the PKZIP hash parser in hashcat. When a user supplies a PKZIP hash string containing more hex characters than a fixed‑size buffer can accommodate, the overflow can trigger a crash or, if the attacker can influence control flow, arbitrary code execution. The risk is limited to the process that parses the hash file, but it can lead to full compromise of the system if the attacker achieves code execution.

The flaw exists in hashcat version 7.1.2 and affects the PKZIP modules 17200, 17210, 17220, 17225, and 17230. These modules are enabled by default when the corresponding hash type is requested via the CLI. Users running hashcat 7.1.2 or older on any platform where these modules are active are susceptible.

With no EPSS data and no listing in CISA KEV, the likelihood of exploitation is undetermined, but the CVSS score of 9.8 indicates a severe vulnerability due to the buffer overflow. Attackers can host a malicious PKZIP hash file and trigger the overflow by invoking hashcat from the command line or via scripts. Because the flaw arises from unvalidated input, an attacker who can supply the hash string can potentially cause a denial of service or exploit the overflow for code execution in the host environment. The vulnerability is exploitable in any scenario where untrusted hash files are processed without prior validation.