Executive brief
KeePassXC is a popular open-source password manager used to securely store and manage sensitive credentials. A vulnerability in how the application handles its security components allows a local attacker to trick the software into loading a malicious file. If successful, the attacker could gain full access to the target user's password database and execute unauthorized commands on the system.
Technical details
An uncontrolled search path vulnerability (CWE-427) exists in KeePassXC when it performs update checks using OpenSSL. The application attempts to load an OpenSSL configuration file from a hardcoded, unsecured path (C:\Tools\vcpkg\packages\openssl_x64-windows\openssl.cnf). A local attacker with low privileges can create this directory structure and place a malicious configuration file that triggers the loading of an arbitrary DLL. When a target user runs KeePassXC and it triggers an update check, the malicious code executes within the context of that user's process, leading to a full compromise of the password database and local privilege escalation. This issue is resolved in version 2.7.12.
Affected products
- KeePassXC Team KeePassXC <= 2.7.11
Timeline
- 2026-02-03: other: Vulnerability identified by researcher
- 2026-03-03: disclosed: Reported to vendor
- 2026-03-09: patched: Vendor published GHSA advisory and version 2.7.12
- 2026-03-16: advisory: ZDI advisory published
- 2026-04-11: other: NVD publication date