CVE-2026-42483 Details
Description
A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer.
A heap-based buffer overflow vulnerability has been identified in the Kerberos hash parser of Hashcat version 7.1.2. This vulnerability allows an attacker to cause a denial-of-service condition or possibly execute arbitrary code by using a crafted Kerberos hash file. The issue arises in the 'module_hash_decode' function of several Kerberos-related modules. The vulnerability occurs because the length of the account information is calculated from untrusted delimiter positions without proper validation, allowing for a buffer overflow when the data is copied into a fixed-size buffer.
Users are advised to update to the latest version of Hashcat, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | CISA-ADP | ExploitMitigationThird Party Advisory |
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| hashcat hashcat | 7.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | [email protected] |