CVE-2026-86776 Overview
CVE-2026-86776 is a memory exhaustion vulnerability affecting KeePass versions 2.35 through 2.61.1. The flaw resides in the ReadHeaderField function, which fails to validate KDBX header field sizes before allocating memory. An attacker crafts a malicious .kdbx file that declares excessive header field lengths. When a user opens the file, KeePass attempts to allocate gigabytes of memory, exhausts available resources, and terminates. The weakness is classified as [CWE-789: Memory Allocation with Excessive Size Value]. Exploitation requires local access and user interaction to open the malicious database file.
Critical Impact
A crafted KDBX file causes KeePass to allocate unbounded memory, exhausting system resources and terminating the password manager process.
Affected Products
- KeePass 2.35 through 2.61.1
- KDBX database file parser (ReadHeaderField function)
- Windows, macOS, and Linux installations running affected KeePass builds
Discovery Timeline
- 2026-09-09 - CVE-2026-86776 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86776
Vulnerability Analysis
The vulnerability affects the KDBX header parser inside KeePass 2.x. When KeePass opens a database file, the ReadHeaderField function reads a length field from the file header and uses that value to allocate a buffer. The function does not sanity-check the declared length against the actual file size or against a reasonable upper bound. An attacker who supplies a header claiming a multi-gigabyte field forces the process into an oversized allocation. The allocation either fails immediately or consumes all available physical and virtual memory, causing KeePass to crash before any credentials can be accessed.
Root Cause
The root cause is missing input validation on an attacker-controlled size value, tracked as [CWE-789]. The parser trusts the length declared in the KDBX header and passes it directly to a memory allocator without bounds checking. There is no comparison against file length, no maximum ceiling, and no incremental read strategy. Any malformed header can therefore drive resource consumption on the host.
Attack Vector
Exploitation requires local file interaction. An attacker delivers a crafted .kdbx file through email attachment, shared network drive, cloud sync, or removable media. When the victim double-clicks the file or opens it inside KeePass, the parser reads the malicious header and issues the oversized allocation. The result is a denial-of-service condition against the password manager. The vulnerability does not yield code execution or credential disclosure, but it can disrupt access to stored secrets and, in shared workstations, contribute to broader availability impact.
No verified proof-of-concept code is reproduced here. A public repository is referenced by the reporter at KDBX Header Size Mirage PoC, and technical details are described in the VulnCheck Advisory on KeePass.
Detection Methods for CVE-2026-86776
Indicators of Compromise
- KeePass 2.x process terminating shortly after opening a .kdbx file from an untrusted source
- Sudden spikes in committed memory attributable to KeePass.exe followed by process exit
- Windows Event Log entries showing Application Error or out-of-memory exceptions tied to KeePass
- Inbound .kdbx attachments from external senders or unfamiliar cloud shares
Detection Strategies
- Monitor endpoint telemetry for KeePass processes whose private working set exceeds a defined threshold, for example 2 GB, within seconds of launch
- Alert on KeePass process crashes correlated with recent file-open events targeting .kdbx files outside standard user vault paths
- Inspect email and file-share gateways for .kdbx files originating from untrusted domains or unknown senders
Monitoring Recommendations
- Ingest KeePass process telemetry, application error events, and file-open events into a centralized analytics platform
- Baseline normal KeePass memory usage per user and generate alerts on statistical outliers
- Track distribution of .kdbx files across file shares and cloud storage to identify unexpected new database files
How to Mitigate CVE-2026-86776
Immediate Actions Required
- Upgrade KeePass to a version later than 2.61.1 once a fixed release is published on the KeePass Download Page
- Instruct users to open only .kdbx files originating from trusted sources and their own vaults
- Block or quarantine inbound .kdbx attachments at email and web gateways until a patched build is deployed
- Restrict write access to shared locations where KeePass databases are stored
Patch Information
Users should track the KeePass Official Website for release notes addressing CVE-2026-86776. Consult the VulnCheck Advisory on KeePass for current fix status. Deploy the updated build through standard software distribution channels and verify the installed version reports higher than 2.61.1.
Workarounds
- Do not open .kdbx files received from external or untrusted parties
- Enforce application allowlisting so that only sanctioned KeePass builds can execute
- Configure operating system per-process memory limits where supported, for example Windows Job Objects, to cap KeePass memory consumption
- Maintain offline backups of legitimate KeePass databases to recover from crash-induced disruption
# Verify installed KeePass version on Windows
"C:\Program Files\KeePass Password Safe 2\KeePass.exe" --version
# Example: block .kdbx attachments at an SMTP gateway (pseudocode rule)
if attachment.extension == ".kdbx" and sender.domain not in trusted_domains:
quarantine(message, reason="CVE-2026-86776 mitigation")
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
