This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-68767 →

DEBIAN-CVE-2026-68767

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer l...

Original description

The description as published by the source.

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 hashcat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org