CVE-2026-68768

Name of the Vulnerable Software and Affected Versions hashcat (affected versions not specified)

Description A heap-based buffer overflow occurs in the outfile write() function within src/outfile.c. The issue arises when the software assembles output into a fixed-size buffer (HCBUFSIZ LARGE, approximately 16 MB) by sequentially appending the username, separator, hash, and plaintext using memcpy. Because the function fails to validate if the accumulated length exceeds the buffer capacity, providing a crafted hash file with an oversized username while using the --username and --show flags can cause the total output to exceed the buffer. This results in an out-of-bounds write that can corrupt memory and crash the process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.