{"id":"CVE-2026-68767","summary":"hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()","details":"hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.","modified":"2026-08-28T14:33:07.309708Z","published":"2026-08-22T14:12:43.477Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-193"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68767.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68767.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68767"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl"},{"type":"REPORT","url":"https://github.com/hashcat/hashcat/issues/4739"},{"type":"FIX","url":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"type":"PACKAGE","url":"https://github.com/hashcat/hashcat"},{"type":"ARTICLE","url":"https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hashcat/hashcat","events":[{"introduced":"0"},{"fixed":"93b55d37d3b2340013d4036f10181ddc67d44249"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"7.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v7.1.2","v7.1.1","v7.1.0","v7.0.0","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.1.1","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0","v5.1.0","v5.0.0","v4.2.1","v4.2.0","v4.1.0","v4.0.1","v4.0.0","v3.6.0","v3.5.0","v3.40","v3.30","v3.20","v3.10","v3.00","v3.00-beta","v2.01","v2.00"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68767.json","vanir_signatures_modified":"2026-08-28T14:33:07Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_wordlist.c"},"deprecated":false,"digest":{"line_hashes":["323210627165960333125747155391609750764","54377257949177599048001283774789824592","122903818030431217621311555181762864880","167003791296651046263734002176092618759","273092546216495386438783495119422137205","330412241161058088753444472274339553634","210170152741906239579219669948970045201","325577838431199453462699996628051245024","197792479024167049922407175634803088010","148115839896445819467100991770545642069","38709028219560258596269825342803591284","17122630381628184581321324062442436952","329565602088369177282122193266350034599","106456236864466638593432463896701510881","239792876665843071910512543339009962546","171550747411752739941755752045171616887","36841288480907427329504470524498123611","276167858739415534709755247682975283165","314543529769670817220395162945893548746","240474918383391241375888410047098425166","151621425364386580624146185585581884878","57432524241594940175328412813939933779","236563319834455324951675559552921825033","185539021732350610140637643922051149201","94557883642772577507561437232507316734"],"threshold":0.9},"id":"CVE-2026-68767-0fe6daba","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_stdin.c","function":"thread_next"},"deprecated":false,"digest":{"function_hash":"123285489574051971080168870995004217270","length":1420},"id":"CVE-2026-68767-23e39ac9","signature_type":"Function"},{"target":{"file":"src/filehandling.c","function":"fgetl"},"deprecated":false,"digest":{"function_hash":"284224533965415478245749704695140368452","length":496},"id":"CVE-2026-68767-2c80d0ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"target":{"file":"src/feeds/feed_stdin.c","function":"thread_term"},"deprecated":false,"digest":{"length":184,"function_hash":"57221956294032308103924564486291216269"},"id":"CVE-2026-68767-3141251f","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"target":{"file":"src/filehandling.c","function":"count_lines"},"deprecated":false,"digest":{"function_hash":"106324427641320191495535053416224133248","length":394},"id":"CVE-2026-68767-3699faa3","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"deprecated":false,"digest":{"length":418,"function_hash":"273982439285979448147534754040476582607"},"id":"CVE-2026-68767-43d27389","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/shared.c","function":"hc_memchr_init"}},{"deprecated":false,"digest":{"line_hashes":["327904769976777225571015921565034571431","221074986618026257713394024201284316644","310319030276634821236862551833669146480","73877175368719822611269241800544346752","261018483948566002466824215321761169564","236939404907606340712458816995493874870","180686670378509998107766937978089020217","294556319158193900663897541286030468984","36040922564927709733134580672072257958","96631235517542148591041569748895977230","339102887977867704228421931305989657172","219224021061316666370865632214499514811","173998386526712720230476527219433625650","144213662665758791978471847185212572784","284044723359627791055247740297278561395","161053568004383936923918947247888800945","115007295635412165162815310845966850298","271052845216187192843442739998345514085","10619315574266473770102472000801281341","119278510886547292010780375234661143641","27602884637641215151941876310670416708","328004156116380084995166001670712202712","73328142137626685879064753717391227239","337688297115585842312276529712441841917","252357039532736674225366921201120162471","85812326507711170207975632856660296051","154148039009313524193203077633599212322","183950153172843576627216835573192712911","165078852311154121133386667887318845704","222771975907596695477722642185319691096","155883091057642301809116985704225063807","39786756887909308512178912910282196977","319710909374846660778335416886862826882","233393981135364960410368283608332378146","115582961493051359953679926864919221798","70798777361142068452325321439810514058","57515902649895523322198134779778027181","237010509506428565048042204812323076039","191347064204682153925240044973175438619","37336518355495020320805113005944675746","163391027189339514693855134484143488042","86113675750890737499331766593792013348","116055581511774119615981609211609846608","205232680678128265483238795182801304981","333480627097688467220776421368052354115","53286372704624689595434110641101515643","237123454551696742145793661080705381652","126132312967158870679141518807106861961","92364221188911859316236243788579405600","309812862431992511866905107666239856610","62129209646508582124867092766196118130","26203489974401110712824226710795007539","123946900836698803916482166769649076990","222933836523268134042235054970299689184","274854196129694156050816926088739045920","181666755604735693310039170596059485209","195628873290813869040151331901174970125","91060402050522621480166546050658681126","60998797577913911543420353718929972248","293823747748559787049296541201948182011","299085477482521532529233850898716120633","137250309927624676671378458787645349866","39475151129098769503739216339580240456","113340002126811986499676787657508073044","21201556671394480251080465909682172980","115586319239396592405230722375468225628","44240711688731392345549598380833931767","281917842069477056962203012263845901214","319492150062571831545471540919476210037","337280462138302959192485956927170789716","37332997885549940947722619736414971205","208327026647850416259713175410548569110","141619003257675129052423017010578817475","232566870482030802694470727603451408938","10072746258991375740824618983307266957","269011531775429880773234858279493531575","58982938305216667143767556629900751409","184306800107556603721423670968835292867","306983132584235578145548069402043778206","257505697733616942585389644889493559733","13999465411423265593904093059684139120","315721725625979934722499570390286987627","140592338485239893875744840342078582986","90373123805270003305899480666241679932","330565716011144308384488421513243017570","81408328002275949527790942897939078586","169065104023680627645312173784775525946","227385549679150748390780059452440044030","45752771726861346484060850241720529042","206309860563747774871433339706056221821","122819585816791087891051660948489988434","255350473509646884062335212389867974431","52909941780122313732928325961139563815","296054039328501058553840289214566993761","130654910865068685930911866139588628246","335434875374570524146663529368214767042","320070626417854996261146639234388645979","273125612394091958226704966375421699394","231775860281884143030068086069568876891","89815757378423297832553147083875541711","206379695316717941511437901032565776025","74405227887730648394003197400591750736","109884587714311952006559281210726956825","330565716011144308384488421513243017570","199854851901675741010158462128347853980","273687841680509795163088470409522909999","21687872603587281975162718849766644155","250309707301048879443087039803653077364","132818173382800572195518772336627986349","264652309509483345747116423411312363411","130970606596457982222582355888381522439","126217558953277115407016255276015684403","1873829294859124134897772878899256257","84876153152306102958232179119957777079","261097774858328025864010025201996873707","335434875374570524146663529368214767042","320070626417854996261146639234388645979","167617556136603988807797384664961572418","144473741808636131969251149649634202666","197191335186238068147081968520381659399","28732298700966185480587425175561904772","300666709115577782164585607420233272314","107333101649146706996307890660882740624","267639608011433638210744926397425127907","335459033493320715286995646246849278497","133795775500559409635148927400950476979","167247774535979282796536309551771487525","167420258836961807590562071244793701062","303714220129378121525275250838268017873"],"threshold":0.9},"id":"CVE-2026-68767-5208d3fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_stdin.c"}},{"digest":{"function_hash":"149428552344165268309756377738260704969","length":294},"id":"CVE-2026-68767-5e9ef4e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_wordlist.c","function":"process_word"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"281561814572525060534192216711644525904","length":263},"id":"CVE-2026-68767-6070e51b","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_stdin.c","function":"global_term"}},{"signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"include/shared.h"},"deprecated":false,"digest":{"line_hashes":["27552539795093893038538950715674571980"],"threshold":0.9},"id":"CVE-2026-68767-61c79c97","signature_type":"Line"},{"id":"CVE-2026-68767-9395f3eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/feeds/feed_stdin.c","function":"global_init"},"deprecated":false,"digest":{"function_hash":"150188883458757190723514912864365197120","length":314}},{"digest":{"line_hashes":["65148454318679601540912451656249433195","98305083778074255478960210051950048645","51755713159303181554993179204506732487","29578624856254734678550137239321406454","78772807737445684585815733220437525347","78830177790953231069808653399847146059","5965926879704188207108034310643244638","130522019716641345336015004174072143782"],"threshold":0.9},"id":"CVE-2026-68767-b2e5ba07","signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249","target":{"file":"src/shared.c"},"deprecated":false},{"target":{"file":"src/feeds/feed_stdin.c","function":"thread_init"},"deprecated":false,"digest":{"function_hash":"107134551022048385911105620123032156923","length":448},"id":"CVE-2026-68767-bd6efdff","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"target":{"function":"thread_next","file":"src/feeds/feed_wordlist.c"},"deprecated":false,"digest":{"length":690,"function_hash":"142036416992042187175192518820421349601"},"id":"CVE-2026-68767-c86a966d","signature_type":"Function","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"},{"target":{"file":"src/filehandling.c"},"deprecated":false,"digest":{"line_hashes":["206108108054448195920465618168962889275","249563413557529263340566245718460255908","192223400347021707111654578070025994276","72597176478374747159983704659682227456","194147306363734969885040837515584633483","21417962600102303539651346528376448591","173627812992034407672237094255806822725","66735874034603327166600564179528492350","296232419849953197314612269780814322805","97210331891572523751626635052560597979","21095822201440419983567002475684089580","303601405897388663879858496670453983837","119211237061146809304172895636790489963","119185945079540251701509128170595125593","73256975733465561051239203838229654834","335328372894686995354502175455010177727","209317731561850381883767401668553814403","255791333580442454570710611333365575499","2177683362720028416756831403025955000","159406485512171732535787635751773273201","222549696596872314677741985059013336240","131546084380551773896849688239148514593","274300167377193126216835246996525250077","23337102387378462410222629824437953505","240367313456961994168765691795568463630","60257490461273125621848835007198715997","132390490693114754922742998367113642697","199314479386925642976383763875597403016","120304994512804914779474747508491774677","16004729132873263113647642676535312625","224241602005982022522036810066621734449","102006006726646055395990688640354472994","237149605558732486855133397581877027365","323786827843722328174862646889796392815","242216758791756316699949903389907834728","164646463390413186349227347059919812677","140874516857723543914562400290105855656"],"threshold":0.9},"id":"CVE-2026-68767-f173d4ec","signature_type":"Line","signature_version":"v1","source":"https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}