CVE-2026-42483: Hashcat Buffer Overflow Vulnerability

CVE-2026-42483 Overview

CVE-2026-42483 is a heap-based buffer overflow in the Kerberos hash parser of hashcat v7.1.2. The flaw resides in module_hash_decode across multiple Kerberos-related modules. The parser calculates account_info_len from untrusted delimiter positions in the hash file without enforcing an upper bound. A subsequent memcpy then writes attacker-controlled data into a fixed-size account_info buffer on the heap.

The vulnerability is tracked under [CWE-787] (Out-of-Bounds Write) and [CWE-122] (Heap-Based Buffer Overflow). Successful exploitation can cause denial of service or arbitrary code execution when a victim processes a crafted Kerberos hash file.

Critical Impact

A crafted Kerberos hash file can trigger heap corruption in hashcat v7.1.2, enabling denial of service or arbitrary code execution.

Affected Products

• Hashcat v7.1.2
• Kerberos hash parsing modules invoking module_hash_decode
• Workflows that ingest third-party or untrusted Kerberos hash files

Discovery Timeline

• 2026-05-01 - CVE-2026-42483 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-42483

Vulnerability Analysis

Hashcat parses Kerberos hash strings by locating $ delimiters that separate fields such as the realm, account name, and ciphertext. The parser computes account_info_len by subtracting offsets between delimiters in the input string. This length is then passed directly to memcpy, which copies the bytes into the fixed-size account_info member of the parsed hash structure.

No upper-bound check validates that the computed length fits within the destination buffer. An attacker who controls the delimiter placement controls the length value. Supplying a long account segment causes memcpy to write past the end of the heap allocation. The corruption affects multiple Kerberos modules that share this decoding pattern.

Root Cause

The root cause is missing bounds validation on a length value derived from untrusted input. The decoder trusts the relative positions of $ delimiters to compute the copy size. Because the destination is a fixed-size buffer, any input larger than that buffer overflows the heap region. This pattern is a classic instance of [CWE-122] heap buffer overflow driven by improper input validation.

Attack Vector

Exploitation requires the victim to load a malicious hash file with hashcat. The attack vector is network-reachable in the sense that hash files are commonly distributed, downloaded from CTF challenges, shared in incident response engagements, or pulled from artifact repositories. No authentication or user interaction beyond loading the file is required by hashcat itself. An attacker crafts a Kerberos hash entry where the segment between delimiters exceeds the size of account_info, then delivers it to the target. See the GitHub Gist proof of concept for technical details.

Detection Methods for CVE-2026-42483

Indicators of Compromise

• Crashes or abnormal terminations of the hashcat process while parsing Kerberos hash files (modes 7500, 13100, 18200, 19600, 19700, 19800, 19900)
• Kerberos hash files containing unusually long fields between $ delimiters, particularly in the account name segment
• Unexpected child processes spawned from hashcat after loading an externally sourced hash file
• Heap corruption signatures in core dumps referencing module_hash_decode

Detection Strategies

• Inventory all systems running hashcat and flag any instance at version 7.1.2 or earlier
• Inspect Kerberos hash inputs and reject entries where any delimiter-bounded field exceeds expected lengths
• Run hashcat workloads under AddressSanitizer in lab environments to surface heap overflows during validation
• Correlate process telemetry with hash file ingestion events to identify suspicious parsing activity

Monitoring Recommendations

• Alert on hashcat process crashes followed by attempts to restart with the same input file
• Monitor file transfers and downloads of .hash, .kerb, or similar files from untrusted sources
• Track command-line invocations of hashcat with -m 7500, -m 13100, -m 18200, and other Kerberos modes
• Log endpoint binary execution to identify deployments of vulnerable hashcat versions across the fleet

How to Mitigate CVE-2026-42483

Immediate Actions Required

• Stop processing untrusted Kerberos hash files with hashcat v7.1.2 until a fixed release is available
• Restrict hashcat execution to dedicated, isolated analysis hosts that do not hold sensitive credentials
• Review hash files received from external parties for abnormally long fields before loading
• Track the hashcat project advisory channels for an upstream patch

Patch Information

No fixed version is referenced in the published advisory at the time of NVD publication on 2026-05-01. Monitor the upstream hashcat repository for a release that adds upper-bound validation to account_info_len before the memcpy call in module_hash_decode. Apply the update across all hosts where hashcat v7.1.2 is installed once available.

Workarounds

• Downgrade to a prior hashcat release that does not contain the vulnerable Kerberos decoder, after verifying it is unaffected
• Run hashcat inside a container or sandbox with no network access and minimal filesystem privileges
• Pre-validate Kerberos hash files with a script that enforces a maximum field length between $ delimiters
• Limit hashcat execution to a non-privileged service account on a dedicated workstation

# Example pre-validation: reject Kerberos hash lines with oversized fields
awk -F'$' '{ for (i=1;i<=NF;i++) if (length($i) > 256) { print "REJECT: " NR; next } } { print "OK: " NR }' suspect.hash