CVE-2026-86776

LowCVSS 3.3

Published: 09/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file with excessive header field lengths to trigger allocation of gigabytes of memory, causing resource consumption and termination.

Risk Assessment

Opening a malicious KDBX file can cause KeePass to crash, potentially leading to denial of service and possible data loss.

Recommendation

Update KeePass to a version newer than 2.61.1 that includes the fix.

Other vulnerabilities in KeePass

CVE-2017-1000066High
The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information.

Original NVD description (English source)

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.