CVE-2026-42484
Critical · 9.8CVSS
9.8
EPSS
0.4%
Published
May 1, 2026
CISA due date
—
The record
A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When data_type_enum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-78402 Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys… CWE-787
- CVE-2026-119777 A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. CWE-787
- CVE-2026-104065 Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw… CWE-787
- CVE-2026-104067 Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the… CWE-787
- CVE-2026-104066 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image… CWE-787
- CVE-2026-104061 Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the… CWE-787
- CVE-2026-104062 Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image… CWE-787
- CVE-2026-61627 libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation… CWE-787