KeePassXC allows a crafted legacy KeePass1 (.kdb) file to trigger a heap use-after-free through a stale pointer in the m_entryUuids map. When the import routine processes a KPX_CUSTOM_ICONS_4 metastream that references a previously removed entry, the application calls Entry::setIcon on a released pointer, resulting in a controlled write followed by a process crash. The vulnerability does not provide remote code execution or privilege escalation; its primary impact is a forced termination of the application, disrupting user workflow.

The flaw affects KeePassXC versions earlier than 2.8.0-beta1. The affected product is the keepassxreboot:keepassxc application, particularly its KeePass1/KDB legacy import functionality.

The CVSS score is 4.3, indicating a moderate severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Externally, a malicious actor would need local access to the victim’s machine or an opportunity to trick the user into opening a specially crafted .kdb file. The attack vector is inferred as a local, user‑initiated file import, requiring no network interaction or elevated privileges. The likelihood of exploitation in the wild is low, but the crash can impact service availability.