CVE-2026-86776 | BDVDB-2026-370821 Detail
KeePassKeePass
Description#
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact none, availability impact low. Attack vector: local.
Weaknesses#
- CWE-789 Memory Allocation with Excessive Size Value
References#
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.