{"id":"CVE-2026-68766","summary":"hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection","details":"hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.","modified":"2026-08-26T01:42:14.053645Z","published":"2026-08-22T14:12:42.748Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-88"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68766.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68766.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68766"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/hashcat-through-arbitrary-file-write-via-restore-file-option-injection"},{"type":"REPORT","url":"https://github.com/hashcat/hashcat/issues/4738"},{"type":"FIX","url":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4"},{"type":"PACKAGE","url":"https://github.com/hashcat/hashcat"},{"type":"ARTICLE","url":"https://github.com/hashcat/hashcat/blob/v7.1.2/src/restore.c#L365-L369"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hashcat/hashcat","events":[{"introduced":"0"},{"fixed":"fcae69f2438ff8eae0dc8e206b78067a1e465ed4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"7.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v7.1.2","v7.1.1","v7.1.0","v7.0.0","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.1.1","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0","v5.1.0","v5.0.0","v4.2.1","v4.2.0","v4.1.0","v4.0.1","v4.0.0","v3.6.0","v3.5.0","v3.40","v3.30","v3.20","v3.10","v3.00","v3.00-beta","v2.01","v2.00"],"database_specific":{"vanir_signatures_modified":"2026-08-26T01:42:14Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"166693486356784943547791905002354082496","length":13389},"id":"CVE-2026-68766-08eaef42","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/user_options.c","function":"user_options_getopt"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/restore.c"},"deprecated":false,"digest":{"line_hashes":["25484817517709055754739157520710048291","213161026604589331776890393839282355963","2618331852769615384406022857401440672","293778440282758027427758129594118613481","133780254449236578868383626863632180181","180907332870226991014081751453940972332","311457948605289735135930307908285899704","103211454061173138738885590477426201206","24365605660534124442591624103330569456","9776784574745821884296643451985115394","182648462931811884461596712739936347613","221673287163420565049874064466936410890","90526696818640721678436742154127842603","335001372384960885807608922216680566929","182677889989839520182184151509232309404","139458831093619803755132778754964695243","169758335482438975761053709288817870566","23988107244795127020894658764129444819","132808855525437526432159195640485101197","182677889989839520182184151509232309404","35397157134578521247284804328932223687","107383209145735386675563413971233502422","283479007082983043911586589196429292677","158352696236050324117756570236588509309","206270646733866097173414043213391952516","312556504055445822196108691448917690231","236941121269934617529770964442242471166","212410758215013623871618042893670321035","261514174692820964505780764761783103369","300405299081845161019582012012278525561","213166272005776976619249672808985747770","126460526190568049674600543389274185358","107657728286029091529837746414369865337","121898592921439279163343796194825839253","297718505988462260569800142611401035568","238065421968941780498553907230895737963","162789555376282137701371329227730565300","212923777522944315896309390647557370145","62791999387013870404399197266520887410","4926749591274663909107142329298519265","116852665787179432452086691065263953776","317565640702533042213604203253127973449","43978958996619068305013770004786505905","269875524145404078633476074186946086710","149904611082883020039956998969292037932"],"threshold":0.9},"id":"CVE-2026-68766-13031f3f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/user_options.c","function":"user_options_init"},"deprecated":false,"digest":{"function_hash":"41768507209540305125599886837301550511","length":5271},"id":"CVE-2026-68766-1e9ac1ce"},{"deprecated":false,"digest":{"function_hash":"206932704876659033841155794046373599463","length":1789},"id":"CVE-2026-68766-36959eab","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/restore.c","function":"restore_ctx_init"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/hashcat.c","function":"hashcat_session_init"},"deprecated":false,"digest":{"function_hash":"41624464040312906197812316636931994924","length":2018},"id":"CVE-2026-68766-39122baa"},{"source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/main.c"},"deprecated":false,"digest":{"line_hashes":["86746787507310406654701237092849960775","11580664087568628862663037181239288462","37835586480498900185029018664801881631","245034910418947684138951186502540992080"],"threshold":0.9},"id":"CVE-2026-68766-4547fcf1","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"231424065130419013713768386584332995669","length":5220},"id":"CVE-2026-68766-58e708d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/user_options.c","function":"user_options_preprocess"}},{"digest":{"line_hashes":["146493439154798890829887123584404319449","300786527693200794278831912231741646827","37420637621488375648974150545736903865","201504002127613041905234736950408627792","168975376211367029090886657856779873415","14409239383474005189123740186429676931","209342189011407664547377439046022678272","51690276606778538062189067613534673557","54900679828271463764829346709050870600","221602362811611887352229191677781185317","175054806973507538563937284162641975416","238875132385981095233538384473351573476","278730672289974440470081960301378038583","110825926477713803259168475805860558784","171285138444284411264800319615598139610","248854471132867782448097568078308594434","191212881392381434205393901746823910087","256226908724437044164837056737483700856","114463415252466942995152275026704754867","169465199945496655526812326815891205852","283328095733433102731338139792825179234","156874995504687256460145428765094745250","163743049836588742629723338802430552771","254098324421038739214484068433611583327","89763887786619846493685471331534354031","171209456670494839147145253659163606098","236326327406472240680174150440320497541","219525222478894689869132865254090642280","30137683197367962793219359537354624465","171209456670494839147145253659163606098","236326327406472240680174150440320497541","219525222478894689869132865254090642280","30137683197367962793219359537354624465","99103121752636218692270909188931191321","198833502982698643458469870141236842910","219525222478894689869132865254090642280","7260244691013085478631976960614460592","267296264384703168500000439373449053024","88238849901572431656306289753227570263","258009490372309416711172714174989310039","171685855422207063919178398507115799086","135164910620087267108246244191122403690","286068221048158794544123471406658462625","301769496069919895003917793730113511031","156401066070367583610344905660976000762","40252517574372070796919190963227782399"],"threshold":0.9},"id":"CVE-2026-68766-61339f0c","signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/user_options.c"},"deprecated":false},{"target":{"function":"user_options_logger","file":"src/user_options.c"},"deprecated":false,"digest":{"function_hash":"47958485793958971357970946967172962292","length":4601},"id":"CVE-2026-68766-6a204b48","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4"},{"source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/hashcat.c"},"deprecated":false,"digest":{"line_hashes":["329638780593491614231258196672154444509","18019907655813259335503438379602738243","146080555430076047673696644531601634277"],"threshold":0.9},"id":"CVE-2026-68766-6f34bb25","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-68766-77c83532","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/restore.c","function":"read_restore"},"deprecated":false,"digest":{"function_hash":"146900142311578117912506277803344026899","length":2743}},{"digest":{"line_hashes":["44974959148586947402139660694831366225","315518179352729029185884249259157855557","69195625584278239323792467237961267611","210225951991237704618573194146980758444","91366658715906449040645885920278114894","27389243029195292869669102323340856401"],"threshold":0.9},"id":"CVE-2026-68766-924bb669","signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/usage.c"},"deprecated":false},{"digest":{"function_hash":"314891739621978257506905935943250948233","length":30772},"id":"CVE-2026-68766-c54df089","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/user_options.c","function":"user_options_sanity"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"include/types.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["243595547664649096122548631699514987759","170926031734166783870593492755042486605","181653710991004047618351597783674237716","106501769307417624398065451413063987139","242713724286937876845749492555822319469","183025157873551917636696807320406274887","31849882711182570578102299881123113063","192269941414050058652315177964894604298","34372739248764803544224582964491417272","290713629060306594389758435565182148062","114127831980493592565374690114921397911","139940272210585998935620325521259809095","42162791122829803716624792699632892042","23849021981480174368618243834833991239","180889154187442153573090678363748692399","82738002722661414001809060911609772516","314280592212839654942528343905269919525","194457807569034612281999379458774317917"]},"id":"CVE-2026-68766-e65a6819"},{"deprecated":false,"digest":{"function_hash":"227140917963074708685206148584521660472","length":1764},"id":"CVE-2026-68766-edd09fac","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4","target":{"file":"src/main.c","function":"main"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68766.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}