KeePass versions 2.35 through 2.61.1 do not validate header field sizes in the KDBX file format before allocating memory. This flaw is a classic instance of CWE-789: Uncontrolled Memory Allocation. An attacker can create a KDBX file that reports extremely large header field lengths, causing the application to attempt to allocate multiple gigabytes of memory. This memory exhaustion can lead to the program terminating with an out‑of‑memory error, interrupting use of the password manager and potentially affecting any services that rely on it.

The vulnerability impacts KeePass, a widely used open‑source password manager. All releases from version 2.35 up to and including 2.61.1 are affected. No specific operating system is required; the flaw exists in the application code independent of the host platform.

The CVSS score of 4.6 indicates moderate severity. An attacker would need to supply a malicious KDBX file, so the primary attack vector is local, although compromised files could be delivered remotely if the user opens a file from an untrusted source. No evidence of public exploitation exists, and the vulnerability is not listed in the CISA KEV catalog. Because the EPSS score is unavailable, the likelihood of widespread exploitation cannot be precisely quantified, but the attack path requires user interaction with the file.