Quick answers
- Is CVE-2026-68768 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-68768 being exploited in the wild.
- How severe is CVE-2026-68768?
- Medium severity, with a CVSS score of 6.1, published 22 August 2026.
- Which products and versions are affected?
- Hashcat prior to v7.2.0.
- Is there a fix for CVE-2026-68768?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-68768 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-68768?
- Check whether you run Hashcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. The function sequentially appends username, separator, hash, and plaintext to a fixed-size buffer (HCBUFSIZ_LARGE, approximately 16 MB) using memcpy without validating the accumulated length against buffer capacity. When run with --username --show against a crafted hash file containing an oversized username, the total assembled output exceeds the buffer boundary, causing heap corruption. Attack vector is local; requires the attacker to supply a malicious hash file to the hashcat process.
Affected products
- hashcat hashcat prior to v7.2.0
Timeline
- 2026-08-22: disclosed