Hashcat’s outfile_write() function assembles output into a fixed-size buffer without validating the cumulative length of the username, separator, hash, and plaintext. When run with the --username --show options on a hash file containing an oversized username that nearly fills the buffer, the function writes beyond the buffer boundary, corrupting memory and causing the process to crash. The overflow could also be leveraged by an attacker to manipulate memory contents, potentially leading to arbitrary code execution in contexts where hashcat runs with elevated privileges.

The vulnerability affects hashcat version 7.1.2 and is specific to the outfile_write() implementation in src/outfile.c. No other versions are listed as affected in the available data.

With a CVSS score of 6.9, the vulnerability is considered moderate to high impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires local access to run hashcat and a crafted hash file with an oversized username; thus, the attack vector is local. An attacker could crash the tool or exploit the memory corruption to gain control over the process payload if additional vulnerabilities exist.