CVE-2026-68767: hashcat Buffer Overflow Vulnerability

CVE-2026-68767 Overview

CVE-2026-68767 is an off-by-one out-of-bounds heap write in hashcat's fgetl() function within src/filehandling.c. The function writes a null terminator one byte past the caller's buffer when an input line matches the buffer length exactly. Attackers trigger this heap corruption by supplying a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes. The flaw is classified under CWE-193 (Off-by-one Error). Exploitation requires local access and user interaction to load the malicious file.

Critical Impact
A crafted input file passed to hashcat triggers a one-byte heap out-of-bounds write, corrupting adjacent heap metadata and enabling process crashes or potential memory corruption during password auditing workflows.

Affected Products

hashcat versions through v7.1.2
Deployments consuming untrusted hash files, potfiles, or wordlists
Automated password auditing pipelines built on hashcat

Discovery Timeline

2026-08-22 - CVE-2026-68767 published to NVD
2026-08-26 - Last updated in NVD database
Patch commit - Fix landed in hashcat commit 93b55d3

Technical Details for CVE-2026-68767

Vulnerability Analysis

The fgetl() routine in src/filehandling.c reads a line from a file into a caller-provided buffer. When the input line length equals HCBUFSIZ_LARGE, the function still appends a terminating null byte at position len, writing one byte beyond the allocated buffer boundary. This classic off-by-one condition corrupts adjacent heap memory. See the vulnerable code region and the VulnCheck advisory for the full analysis.

Root Cause

The root cause is a boundary condition error in the line-reading logic. fgetl() does not reserve space for the trailing null when validating the read length. When a line consumes the full buffer, writing the null terminator overflows into the next heap chunk. This can corrupt heap allocator metadata or adjacent object state depending on runtime layout.

Attack Vector

Exploitation requires the target to run hashcat against an attacker-supplied file. An adversary crafts a wordlist, potfile, or hash file that contains at least one line exactly HCBUFSIZ_LARGE bytes long. When hashcat parses the file, fgetl() performs the one-byte overwrite. Impact ranges from denial of service to memory corruption. See GitHub issue #4739 for reproduction details.

// Fix from commit 93b55d3 introduces block-based line parsing
// via a new inline helper in include/shared.h

static inline size_t hc_line_next (const u8 *buf, const size_t max_len, size_t *out_len)
{
  hc_memchr_t hc_memchr = hc_memchr_get ();

  const size_t step = hc_memchr (buf, '\n', max_len);

  size_t line_len = step;
  // ...
}
// Source: https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249

The patch consolidates line parsing into a single helper that returns the delimiter position or max_len, so callers no longer terminate buffers they do not own. This eliminates the off-by-one write path in fgetl().

Detection Methods for CVE-2026-68767

Indicators of Compromise

Hashcat process crashes with heap corruption signatures such as malloc_consolidate or free() aborts during file ingestion
Wordlists, hash files, or potfiles containing lines of exactly HCBUFSIZ_LARGE bytes without a trailing newline
Unexpected hashcat termination immediately after loading a specific input file

Detection Strategies

Inventory hashcat binaries across endpoints and compare versions against v7.1.2 or earlier
Scan file shares and analyst workstations for oversized single-line inputs supplied to hashcat runs
Enable AddressSanitizer or similar heap instrumentation in test environments to surface the out-of-bounds write during CI

Monitoring Recommendations

Log command-line invocations of hashcat along with input file paths and sizes
Alert on hashcat process crashes and correlate with the input file that was being consumed
Track integrity of shared wordlist and potfile repositories to detect tampering

How to Mitigate CVE-2026-68767

Immediate Actions Required

Upgrade hashcat to a version that includes commit 93b55d3 or later
Restrict hashcat execution to trusted operators and validated input files
Audit shared wordlist and potfile stores for attacker-controlled content

Patch Information

The fix is committed to the hashcat repository in commit 93b55d37d3b2340013d4036f10181ddc67d44249. It refactors line reading into a shared hc_line_next() helper that computes line length via hc_memchr without appending a null terminator to caller-owned buffers. Rebuild hashcat from source at or after this commit, or upgrade to the next tagged release beyond v7.1.2.

Workarounds

Reject or truncate any input file line that reaches HCBUFSIZ_LARGE bytes before passing files to hashcat
Run hashcat inside a sandbox or container with limited privileges and no access to sensitive host resources
Only process hash files, potfiles, and wordlists from trusted internal sources until patched builds are deployed

bash

# Pre-flight check: fail if any line reaches HCBUFSIZ_LARGE (default 0x40000)
MAX=$((0x40000))
awk -v max="$MAX" 'length($0) >= max { print "oversized line: " NR; exit 1 }' "$1"