CyberRota Analysis
AI-GeneratedThe vulnerability exists in the outfile_write() function of hashcat, where a heap-based buffer overflow occurs due to inadequate validation of the accumulated output size when processing oversized usernames. This flaw can lead to memory corruption and potential crashes when handling specially crafted hash files with the --username --show option. Users and organizations utilizing hashcat for password recovery or hash cracking should prioritize patching or mitigating this issue to prevent exploitation and ensure system stability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.