hashcat vulnerabilities

In version 7.1.2 of hashcat, there is a heap-based buffer overflow in the Kerberos hash parser, allowing an attacker to cause a denial of service or potentially execute arbitrary code via a crafted Kerberos hash file.

A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in hashcat v7.1.2 allows for denial of service or arbitrary code execution via a crafted rule file or the -j or -k options with password candidates of 128 or more characters.

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity.

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301). An oversized ninth hash field token can corrupt adjacent heap memory, potentially leading to heap corruption or memory access violations.