Piotr Kowalczyk

The software fails to restrict command-line options when parsing restore files. This allows attackers to inject output-redirecting options, such as `--outfile` and `--potfile-path`. By crafting restore files with these malicious options, an attacker can append controlled content to arbitrary files, which may lead to code execution if shell startup files are targeted.

The `fgetl()` function in src/filehandling.c contains an out-of-bounds heap write. This occurs when the function writes a null terminator one byte beyond the caller's buffer if an input line is exactly the buffer length. An attacker can trigger this issue by providing a wordlist, potfile, or hash file containing a line of exactly `HCBUFSIZ LARGE` bytes.

A heap-based buffer overflow occurs in the `outfile write()` function within src/outfile.c. The issue arises when the software assembles output into a fixed-size buffer (`HCBUFSIZ LARGE`, approximately 16 MB) by sequentially appending the username, separator, hash, and plaintext using memcpy. Because the function fails to validate if the accumulated length exceeds the buffer capacity, providing a crafted hash file with an oversized username while using the `--username` and `--show` flags can cause the total output to exceed the buffer. This results in an out-of-bounds write that can corrupt memory and crash the process.

A heap buffer overflow exists in the KeePass AESKDF/KDBX v4 module (module 34301). The issue occurs when the module processes the ninth hash field token; while it accepts up to 600 hex characters, it decodes this data into a fixed 256-byte buffer without performing a length check. This allows an oversized input to write up to 44 bytes beyond the buffer boundary into adjacent esalt fields and heap chunk metadata, which can lead to heap corruption or memory access violations.