CVE-2026-68767

Medium

Description

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

SeverityMedium

CVSS6.1

Exploit probability—

ProductHashcat

PublishedAug 22, 2026

First seenAug 22, 2026

Weakness typeCWE-193CWE-193

How to fix

Patches

github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249

Affected products

Product	Affected versions	Fixed in
hashcat hashcat	v ≤ 7.1.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.