SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-68768

MEDIUM · CVSS 6.1 EPSS 0.14% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability exists in the outfile_write() function of hashcat, where a heap-based buffer overflow occurs due to inadequate validation of the accumulated output size when processing oversized usernames. This flaw can lead to memory corruption and potential crashes when handling specially crafted hash files with the --username --show option. Users and organizations utilizing hashcat for password recovery or hash cracking should prioritize patching or mitigating this issue to prevent exploitation and ensure system stability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-68768
Severity
MEDIUM
CVSS
6.1
EPSS
0.14%

Original NVD Description

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.