KeePassXC vulnerabilities

KeePassXC from 2.3.0 until 2.8.0 has a browser integration flaw: authorized response encryption in BrowserMessageBuilder.cpp uses a fixed 1 MiB output vector even though crypto_box_easy() writes plaintext length plus crypto_box_MACBYTES. A browser-protocol client with IPC access and a valid database association can trigger a sequential out-of-bounds write before any response is delivered. Fixed in 2.8.0.

In KeePassXC prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash.

In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.