Hydra, a popular password‑cracking tool, contains a stack buffer overflow in its NTLM authentication handler. The flaw is triggered when a server sends a malicious NTLM Type‑2 challenge with an overly large domain string. The 500‑byte stack buffer is overrun by 18 to 330 bytes, and on systems lacking stack protection an attacker can inject arbitrary code into the process, leading to a classic stack‑based buffer overflow (CWE‑120, CWE‑121).

The vulnerability affects THC Hydra versions 9.7 and earlier. The stack spill occurs in the modules handling SMTP, POP3, IMAP, NNTP, HTTP, HTTP‑Proxy, and HTTP‑Proxy‑Urlenum when processing NTLM challenges. All deployments of Hydra that are configured to attempt NTLM authentication against external servers are potentially exposed.

The CVSS score of 8.6 classifies the flaw as high severity, and the EPSS score is 0.00474 (<1%), though the vulnerability is not listed in the CISA KEV catalog. Because the trigger is a crafted NTLM challenge sent over any of the supported protocols, a remote attacker who can reach a Hydra instance can exploit the loss of stack bounds checks. The exploit requires no privileged access to the target system; it merely needs a network connection and the ability to send a malicious challenge, making it a straightforward remote code execution path.