CVE-2026-68766

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68766
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68766.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68766
Downstream
Published
2026-08-22T14:12:42Z
Modified
2026-08-27T18:53:48Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection
Details

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68766.json"
}
References

Affected packages

Git / github.com/hashcat/hashcat

Affected ranges

Type
GIT
Repo
https://github.com/hashcat/hashcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fcae69f2438ff8eae0dc8e206b78067a1e465ed4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.00
v2.01
v3.*
v3.00
v3.00-beta
v3.10
v3.20
v3.30
v3.40
v3.5.0
v3.6.0
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0
v4.2.1
v5.*
v5.0.0
v5.1.0
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v7.*
v7.0.0
v7.1.0
v7.1.1
v7.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68766.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "166693486356784943547791905002354082496",
            "length": 13389
        },
        "id": "CVE-2026-68766-08eaef42",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c",
            "function": "user_options_getopt"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "25484817517709055754739157520710048291",
                "213161026604589331776890393839282355963",
                "2618331852769615384406022857401440672",
                "293778440282758027427758129594118613481",
                "133780254449236578868383626863632180181",
                "180907332870226991014081751453940972332",
                "311457948605289735135930307908285899704",
                "103211454061173138738885590477426201206",
                "24365605660534124442591624103330569456",
                "9776784574745821884296643451985115394",
                "182648462931811884461596712739936347613",
                "221673287163420565049874064466936410890",
                "90526696818640721678436742154127842603",
                "335001372384960885807608922216680566929",
                "182677889989839520182184151509232309404",
                "139458831093619803755132778754964695243",
                "169758335482438975761053709288817870566",
                "23988107244795127020894658764129444819",
                "132808855525437526432159195640485101197",
                "182677889989839520182184151509232309404",
                "35397157134578521247284804328932223687",
                "107383209145735386675563413971233502422",
                "283479007082983043911586589196429292677",
                "158352696236050324117756570236588509309",
                "206270646733866097173414043213391952516",
                "312556504055445822196108691448917690231",
                "236941121269934617529770964442242471166",
                "212410758215013623871618042893670321035",
                "261514174692820964505780764761783103369",
                "300405299081845161019582012012278525561",
                "213166272005776976619249672808985747770",
                "126460526190568049674600543389274185358",
                "107657728286029091529837746414369865337",
                "121898592921439279163343796194825839253",
                "297718505988462260569800142611401035568",
                "238065421968941780498553907230895737963",
                "162789555376282137701371329227730565300",
                "212923777522944315896309390647557370145",
                "62791999387013870404399197266520887410",
                "4926749591274663909107142329298519265",
                "116852665787179432452086691065263953776",
                "317565640702533042213604203253127973449",
                "43978958996619068305013770004786505905",
                "269875524145404078633476074186946086710",
                "149904611082883020039956998969292037932"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-13031f3f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/restore.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41768507209540305125599886837301550511",
            "length": 5271
        },
        "id": "CVE-2026-68766-1e9ac1ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c",
            "function": "user_options_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "206932704876659033841155794046373599463",
            "length": 1789
        },
        "id": "CVE-2026-68766-36959eab",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/restore.c",
            "function": "restore_ctx_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41624464040312906197812316636931994924",
            "length": 2018
        },
        "id": "CVE-2026-68766-39122baa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/hashcat.c",
            "function": "hashcat_session_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "86746787507310406654701237092849960775",
                "11580664087568628862663037181239288462",
                "37835586480498900185029018664801881631",
                "245034910418947684138951186502540992080"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-4547fcf1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/main.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231424065130419013713768386584332995669",
            "length": 5220
        },
        "id": "CVE-2026-68766-58e708d4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c",
            "function": "user_options_preprocess"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "146493439154798890829887123584404319449",
                "300786527693200794278831912231741646827",
                "37420637621488375648974150545736903865",
                "201504002127613041905234736950408627792",
                "168975376211367029090886657856779873415",
                "14409239383474005189123740186429676931",
                "209342189011407664547377439046022678272",
                "51690276606778538062189067613534673557",
                "54900679828271463764829346709050870600",
                "221602362811611887352229191677781185317",
                "175054806973507538563937284162641975416",
                "238875132385981095233538384473351573476",
                "278730672289974440470081960301378038583",
                "110825926477713803259168475805860558784",
                "171285138444284411264800319615598139610",
                "248854471132867782448097568078308594434",
                "191212881392381434205393901746823910087",
                "256226908724437044164837056737483700856",
                "114463415252466942995152275026704754867",
                "169465199945496655526812326815891205852",
                "283328095733433102731338139792825179234",
                "156874995504687256460145428765094745250",
                "163743049836588742629723338802430552771",
                "254098324421038739214484068433611583327",
                "89763887786619846493685471331534354031",
                "171209456670494839147145253659163606098",
                "236326327406472240680174150440320497541",
                "219525222478894689869132865254090642280",
                "30137683197367962793219359537354624465",
                "171209456670494839147145253659163606098",
                "236326327406472240680174150440320497541",
                "219525222478894689869132865254090642280",
                "30137683197367962793219359537354624465",
                "99103121752636218692270909188931191321",
                "198833502982698643458469870141236842910",
                "219525222478894689869132865254090642280",
                "7260244691013085478631976960614460592",
                "267296264384703168500000439373449053024",
                "88238849901572431656306289753227570263",
                "258009490372309416711172714174989310039",
                "171685855422207063919178398507115799086",
                "135164910620087267108246244191122403690",
                "286068221048158794544123471406658462625",
                "301769496069919895003917793730113511031",
                "156401066070367583610344905660976000762",
                "40252517574372070796919190963227782399"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-61339f0c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "47958485793958971357970946967172962292",
            "length": 4601
        },
        "id": "CVE-2026-68766-6a204b48",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c",
            "function": "user_options_logger"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "329638780593491614231258196672154444509",
                "18019907655813259335503438379602738243",
                "146080555430076047673696644531601634277"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-6f34bb25",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/hashcat.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "146900142311578117912506277803344026899",
            "length": 2743
        },
        "id": "CVE-2026-68766-77c83532",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/restore.c",
            "function": "read_restore"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "44974959148586947402139660694831366225",
                "315518179352729029185884249259157855557",
                "69195625584278239323792467237961267611",
                "210225951991237704618573194146980758444",
                "91366658715906449040645885920278114894",
                "27389243029195292869669102323340856401"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-924bb669",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/usage.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "314891739621978257506905935943250948233",
            "length": 30772
        },
        "id": "CVE-2026-68766-c54df089",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/user_options.c",
            "function": "user_options_sanity"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "243595547664649096122548631699514987759",
                "170926031734166783870593492755042486605",
                "181653710991004047618351597783674237716",
                "106501769307417624398065451413063987139",
                "242713724286937876845749492555822319469",
                "183025157873551917636696807320406274887",
                "31849882711182570578102299881123113063",
                "192269941414050058652315177964894604298",
                "34372739248764803544224582964491417272",
                "290713629060306594389758435565182148062",
                "114127831980493592565374690114921397911",
                "139940272210585998935620325521259809095",
                "42162791122829803716624792699632892042",
                "23849021981480174368618243834833991239",
                "180889154187442153573090678363748692399",
                "82738002722661414001809060911609772516",
                "314280592212839654942528343905269919525",
                "194457807569034612281999379458774317917"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68766-e65a6819",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "include/types.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "227140917963074708685206148584521660472",
            "length": 1764
        },
        "id": "CVE-2026-68766-edd09fac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/fcae69f2438ff8eae0dc8e206b78067a1e465ed4",
        "target": {
            "file": "src/main.c",
            "function": "main"
        }
    }
]
vanir_signatures_modified 
"2026-08-27T18:53:48Z"