CVE-2026-118673

UNKNOWN 0.0

KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.

CWE	CWE-787
Vendor	keepassxreboot
Product	keepassxc
Published	Oct 29, 2026

Stay Ahead of the Next One

Get instant alerts for keepassxreboot keepassxc

Be the first to know when new unknown vulnerabilities affecting keepassxreboot keepassxc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

keepassxreboot / keepassxc

>= 2.3.0, < 2.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227 github.com: https://github.com/keepassxreboot/keepassxc/pull/13679 github.com: https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa github.com: https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0