CVE-2026-68768
Description
A flaw was found in hashcat. A vulnerability exists where the software attempts to write more data than its allocated memory can hold, specifically in the function responsible for writing output files. This can happen when processing a specially crafted hash file containing an excessively long username, combined with specific command-line options. An attacker could exploit this to corrupt memory, leading to a denial of service by crashing the hashcat application.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
The vulnerability in `hashcat` is triggered when processing untrusted hash files with the `--username --show` options. To mitigate this issue, avoid using `hashcat` with untrusted or unverified hash files, especially when employing the `--username` and `--show` flags.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
