CVE-2026-69150

MediumCVSS 4.3

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

In KeePassXC prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash.

Risk Assessment

Opening a crafted .kdb file can crash the application, and the controlled memory write creates potential for further exploitation.

Recommendation

Update KeePassXC to version 2.8.0-beta1 or later and avoid opening .kdb files from untrusted sources.

Other vulnerabilities in KeePassXC

CVE-2023-35866Medium
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.

Original NVD description (English source)

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS