CVE-2026-69150

Name of the Vulnerable Software and Affected Versions KeePassXC versions prior to 2.8.0-beta1

Description An issue exists during the KeePass1 / KDB legacy import process where raw Entry pointers are retained in m entryUuids after metastream entries are deleted. If a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX CUSTOM ICONS 4 metastream referencing that earlier UUID, the parseCustomIcons4() function calls Entry::setIcon() using a stale pointer. This leads to a heap use-after-free—a condition where the program continues to use a pointer after the memory it points to has been freed—resulting in a controlled write and a reliable process crash.

Recommendations Update to version 2.8.0-beta1.