CVE-2026-118673
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
KeePassXC from 2.3.0 until 2.8.0 has a browser integration flaw: authorized response encryption in BrowserMessageBuilder.cpp uses a fixed 1 MiB output vector even though crypto_box_easy() writes plaintext length plus crypto_box_MACBYTES. A browser-protocol client with IPC access and a valid database association can trigger a sequential out-of-bounds write before any response is delivered. Fixed in 2.8.0.
Risk Assessment
Memory corruption in the KeePassXC process may cause crashes or potentially code execution in the user's context. Exploitation requires local IPC access and a valid database association.
Recommendation
Update KeePassXC to version 2.8.0 or later. Restrict access to the browser integration IPC endpoint to trusted processes only.
Other vulnerabilities in KeePassXC
See all- CVE-2026-69150Medium
In KeePassXC prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash.
- CVE-2023-35866Medium
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.
Original NVD description (English source)
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS