Executive brief
hashcat is a password recovery and cracking tool widely used by security professionals and attackers. When processing specially crafted hash files with the --username and --show options, the tool fails to validate that assembled output fits within its internal buffer, leading to a heap overflow that can crash the application or potentially corrupt memory.
Technical details
The vulnerability is a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. The function sequentially appends username, separator, hash, and plaintext to a fixed-size buffer (HCBUFSIZ_LARGE, approximately 16 MB) using memcpy without validating the accumulated length against buffer capacity. When run with --username --show against a crafted hash file containing an oversized username, the total assembled output exceeds the buffer boundary, causing heap corruption. Attack vector is local; requires the attacker to supply a malicious hash file to the hashcat process.
Affected products
- hashcat hashcat prior to v7.2.0
Timeline
- 2026-08-22: disclosed