CVE-2026-68767

MediumCVSS 6.1/10Last modified Oct 14, 2026

Description

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-193

Affected software

Vendor	Product	Versions
hashcat	hashcat	<= 7.1.2

References

Timeline

Published: Aug 22, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-687686.1hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output CVE-2026-68775.3ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Stor CVE-2026-687709.8sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiti CVE-2026-687719.8ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attacker CVE-2026-687728.0ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access CVE-2026-687758.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-687766.5Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687776.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687786.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687796.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-68785.6A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The mani CVE-2026-687806.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.