Vulnerability record · CVE-2026-42483 · published 1 May 2026
CVE-2026-42483: Hashcat out-of-bounds write vulnerability
Hashcat · Hashcat
A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer.
Description
A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | ExploitMitigationThird Party Advisory |
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | ExploitMitigationThird Party Advisory |
Track CVE-2026-42483 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-42483), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.