Executive brief
KeePass is a widely-used password manager that stores encrypted credentials in KDBX database files. A crafted malicious KDBX file can trick the application into allocating excessive amounts of memory during file parsing, causing the application to freeze or crash and preventing users from accessing their passwords.
Technical details
The vulnerability exists in the ReadHeaderField function, which fails to validate header field size values before allocating memory. An attacker can craft a malicious KDBX file with field size declarations in the gigabytes range, triggering a denial-of-service condition when the application attempts to satisfy the memory allocation request. The attack vector is the opening of a malicious KDBX file, no authentication is required. The primary impact is application crash and temporary unavailability of stored credentials, though exploitation in the wild has not been observed. Patches are available in versions after 2.61.1.
Affected products
- KeePass KeePass 2.35 through 2.61.1
Timeline
- 2026-09-09: disclosed