A heap buffer overflow exists in the KeePass AESKDF/KDBX v4 module of hashcat. The module accepts a ninth hash field token of up to 600 hexadecimal characters but writes the decoded data into a fixed 256‑byte buffer without a length check. This allows an oversized input to overwrite up to 44 bytes of heap space beyond the buffer, corrupting adjacent esalt fields and heap chunk metadata. If an attacker can supply such a token, they can corrupt process memory, potentially leading to arbitrary code execution or a denial‑of‑service condition.

The vulnerability is present in hashcat (hashcat:hashcat) master builds following version 7.1.2. All releases built from the master branch after v7.1.2 that incorporate the unpatched KeePass module may be affected. No specific patch version is listed, but the issue is documented in the hashcat repository commits and pull request history.

The CVSS score of 5.2 indicates a moderate severity. EPSS data is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog. The overflow requires the attacker to supply a specially crafted KDBX v4 file or similar input to hashcat; thus, the attack vector is local or application‑injected, not remote. Successful exploitation would corrupt heap memory, enabling potential memory corruption or arbitrary code execution if the beneficiary can overwrite control data structures. The risk is highest in environments where hashcat runs with elevated privileges or processes untrusted credential files.