CVE-2026-68767

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68767
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68767.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68767
Downstream
Published
2026-08-22T14:12:43Z
Modified
2026-08-28T14:33:07Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl()
Details

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-193"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68767.json"
}
References

Affected packages

Git / github.com/hashcat/hashcat

Affected ranges

Type
GIT
Repo
https://github.com/hashcat/hashcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
93b55d37d3b2340013d4036f10181ddc67d44249
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.00
v2.01
v3.*
v3.00
v3.00-beta
v3.10
v3.20
v3.30
v3.40
v3.5.0
v3.6.0
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.2.0
v4.2.1
v5.*
v5.0.0
v5.1.0
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v7.*
v7.0.0
v7.1.0
v7.1.1
v7.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68767.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "323210627165960333125747155391609750764",
                "54377257949177599048001283774789824592",
                "122903818030431217621311555181762864880",
                "167003791296651046263734002176092618759",
                "273092546216495386438783495119422137205",
                "330412241161058088753444472274339553634",
                "210170152741906239579219669948970045201",
                "325577838431199453462699996628051245024",
                "197792479024167049922407175634803088010",
                "148115839896445819467100991770545642069",
                "38709028219560258596269825342803591284",
                "17122630381628184581321324062442436952",
                "329565602088369177282122193266350034599",
                "106456236864466638593432463896701510881",
                "239792876665843071910512543339009962546",
                "171550747411752739941755752045171616887",
                "36841288480907427329504470524498123611",
                "276167858739415534709755247682975283165",
                "314543529769670817220395162945893548746",
                "240474918383391241375888410047098425166",
                "151621425364386580624146185585581884878",
                "57432524241594940175328412813939933779",
                "236563319834455324951675559552921825033",
                "185539021732350610140637643922051149201",
                "94557883642772577507561437232507316734"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68767-0fe6daba",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_wordlist.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "123285489574051971080168870995004217270",
            "length": 1420
        },
        "id": "CVE-2026-68767-23e39ac9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c",
            "function": "thread_next"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "284224533965415478245749704695140368452",
            "length": 496
        },
        "id": "CVE-2026-68767-2c80d0ea",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/filehandling.c",
            "function": "fgetl"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "57221956294032308103924564486291216269",
            "length": 184
        },
        "id": "CVE-2026-68767-3141251f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c",
            "function": "thread_term"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "106324427641320191495535053416224133248",
            "length": 394
        },
        "id": "CVE-2026-68767-3699faa3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/filehandling.c",
            "function": "count_lines"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "273982439285979448147534754040476582607",
            "length": 418
        },
        "id": "CVE-2026-68767-43d27389",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/shared.c",
            "function": "hc_memchr_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "327904769976777225571015921565034571431",
                "221074986618026257713394024201284316644",
                "310319030276634821236862551833669146480",
                "73877175368719822611269241800544346752",
                "261018483948566002466824215321761169564",
                "236939404907606340712458816995493874870",
                "180686670378509998107766937978089020217",
                "294556319158193900663897541286030468984",
                "36040922564927709733134580672072257958",
                "96631235517542148591041569748895977230",
                "339102887977867704228421931305989657172",
                "219224021061316666370865632214499514811",
                "173998386526712720230476527219433625650",
                "144213662665758791978471847185212572784",
                "284044723359627791055247740297278561395",
                "161053568004383936923918947247888800945",
                "115007295635412165162815310845966850298",
                "271052845216187192843442739998345514085",
                "10619315574266473770102472000801281341",
                "119278510886547292010780375234661143641",
                "27602884637641215151941876310670416708",
                "328004156116380084995166001670712202712",
                "73328142137626685879064753717391227239",
                "337688297115585842312276529712441841917",
                "252357039532736674225366921201120162471",
                "85812326507711170207975632856660296051",
                "154148039009313524193203077633599212322",
                "183950153172843576627216835573192712911",
                "165078852311154121133386667887318845704",
                "222771975907596695477722642185319691096",
                "155883091057642301809116985704225063807",
                "39786756887909308512178912910282196977",
                "319710909374846660778335416886862826882",
                "233393981135364960410368283608332378146",
                "115582961493051359953679926864919221798",
                "70798777361142068452325321439810514058",
                "57515902649895523322198134779778027181",
                "237010509506428565048042204812323076039",
                "191347064204682153925240044973175438619",
                "37336518355495020320805113005944675746",
                "163391027189339514693855134484143488042",
                "86113675750890737499331766593792013348",
                "116055581511774119615981609211609846608",
                "205232680678128265483238795182801304981",
                "333480627097688467220776421368052354115",
                "53286372704624689595434110641101515643",
                "237123454551696742145793661080705381652",
                "126132312967158870679141518807106861961",
                "92364221188911859316236243788579405600",
                "309812862431992511866905107666239856610",
                "62129209646508582124867092766196118130",
                "26203489974401110712824226710795007539",
                "123946900836698803916482166769649076990",
                "222933836523268134042235054970299689184",
                "274854196129694156050816926088739045920",
                "181666755604735693310039170596059485209",
                "195628873290813869040151331901174970125",
                "91060402050522621480166546050658681126",
                "60998797577913911543420353718929972248",
                "293823747748559787049296541201948182011",
                "299085477482521532529233850898716120633",
                "137250309927624676671378458787645349866",
                "39475151129098769503739216339580240456",
                "113340002126811986499676787657508073044",
                "21201556671394480251080465909682172980",
                "115586319239396592405230722375468225628",
                "44240711688731392345549598380833931767",
                "281917842069477056962203012263845901214",
                "319492150062571831545471540919476210037",
                "337280462138302959192485956927170789716",
                "37332997885549940947722619736414971205",
                "208327026647850416259713175410548569110",
                "141619003257675129052423017010578817475",
                "232566870482030802694470727603451408938",
                "10072746258991375740824618983307266957",
                "269011531775429880773234858279493531575",
                "58982938305216667143767556629900751409",
                "184306800107556603721423670968835292867",
                "306983132584235578145548069402043778206",
                "257505697733616942585389644889493559733",
                "13999465411423265593904093059684139120",
                "315721725625979934722499570390286987627",
                "140592338485239893875744840342078582986",
                "90373123805270003305899480666241679932",
                "330565716011144308384488421513243017570",
                "81408328002275949527790942897939078586",
                "169065104023680627645312173784775525946",
                "227385549679150748390780059452440044030",
                "45752771726861346484060850241720529042",
                "206309860563747774871433339706056221821",
                "122819585816791087891051660948489988434",
                "255350473509646884062335212389867974431",
                "52909941780122313732928325961139563815",
                "296054039328501058553840289214566993761",
                "130654910865068685930911866139588628246",
                "335434875374570524146663529368214767042",
                "320070626417854996261146639234388645979",
                "273125612394091958226704966375421699394",
                "231775860281884143030068086069568876891",
                "89815757378423297832553147083875541711",
                "206379695316717941511437901032565776025",
                "74405227887730648394003197400591750736",
                "109884587714311952006559281210726956825",
                "330565716011144308384488421513243017570",
                "199854851901675741010158462128347853980",
                "273687841680509795163088470409522909999",
                "21687872603587281975162718849766644155",
                "250309707301048879443087039803653077364",
                "132818173382800572195518772336627986349",
                "264652309509483345747116423411312363411",
                "130970606596457982222582355888381522439",
                "126217558953277115407016255276015684403",
                "1873829294859124134897772878899256257",
                "84876153152306102958232179119957777079",
                "261097774858328025864010025201996873707",
                "335434875374570524146663529368214767042",
                "320070626417854996261146639234388645979",
                "167617556136603988807797384664961572418",
                "144473741808636131969251149649634202666",
                "197191335186238068147081968520381659399",
                "28732298700966185480587425175561904772",
                "300666709115577782164585607420233272314",
                "107333101649146706996307890660882740624",
                "267639608011433638210744926397425127907",
                "335459033493320715286995646246849278497",
                "133795775500559409635148927400950476979",
                "167247774535979282796536309551771487525",
                "167420258836961807590562071244793701062",
                "303714220129378121525275250838268017873"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68767-5208d3fb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149428552344165268309756377738260704969",
            "length": 294
        },
        "id": "CVE-2026-68767-5e9ef4e5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_wordlist.c",
            "function": "process_word"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "281561814572525060534192216711644525904",
            "length": 263
        },
        "id": "CVE-2026-68767-6070e51b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c",
            "function": "global_term"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "27552539795093893038538950715674571980"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68767-61c79c97",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "include/shared.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "150188883458757190723514912864365197120",
            "length": 314
        },
        "id": "CVE-2026-68767-9395f3eb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c",
            "function": "global_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "65148454318679601540912451656249433195",
                "98305083778074255478960210051950048645",
                "51755713159303181554993179204506732487",
                "29578624856254734678550137239321406454",
                "78772807737445684585815733220437525347",
                "78830177790953231069808653399847146059",
                "5965926879704188207108034310643244638",
                "130522019716641345336015004174072143782"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68767-b2e5ba07",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/shared.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "107134551022048385911105620123032156923",
            "length": 448
        },
        "id": "CVE-2026-68767-bd6efdff",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_stdin.c",
            "function": "thread_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "142036416992042187175192518820421349601",
            "length": 690
        },
        "id": "CVE-2026-68767-c86a966d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/feeds/feed_wordlist.c",
            "function": "thread_next"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "206108108054448195920465618168962889275",
                "249563413557529263340566245718460255908",
                "192223400347021707111654578070025994276",
                "72597176478374747159983704659682227456",
                "194147306363734969885040837515584633483",
                "21417962600102303539651346528376448591",
                "173627812992034407672237094255806822725",
                "66735874034603327166600564179528492350",
                "296232419849953197314612269780814322805",
                "97210331891572523751626635052560597979",
                "21095822201440419983567002475684089580",
                "303601405897388663879858496670453983837",
                "119211237061146809304172895636790489963",
                "119185945079540251701509128170595125593",
                "73256975733465561051239203838229654834",
                "335328372894686995354502175455010177727",
                "209317731561850381883767401668553814403",
                "255791333580442454570710611333365575499",
                "2177683362720028416756831403025955000",
                "159406485512171732535787635751773273201",
                "222549696596872314677741985059013336240",
                "131546084380551773896849688239148514593",
                "274300167377193126216835246996525250077",
                "23337102387378462410222629824437953505",
                "240367313456961994168765691795568463630",
                "60257490461273125621848835007198715997",
                "132390490693114754922742998367113642697",
                "199314479386925642976383763875597403016",
                "120304994512804914779474747508491774677",
                "16004729132873263113647642676535312625",
                "224241602005982022522036810066621734449",
                "102006006726646055395990688640354472994",
                "237149605558732486855133397581877027365",
                "323786827843722328174862646889796392815",
                "242216758791756316699949903389907834728",
                "164646463390413186349227347059919812677",
                "140874516857723543914562400290105855656"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-68767-f173d4ec",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249",
        "target": {
            "file": "src/filehandling.c"
        }
    }
]
vanir_signatures_modified 
"2026-08-28T14:33:07Z"