CVE-2026-69150

UNKNOWN 0.0

KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.

CWE	CWE-416
Vendor	keepassxreboot
Product	keepassxc
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for keepassxreboot keepassxc

Be the first to know when new unknown vulnerabilities affecting keepassxreboot keepassxc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

keepassxreboot / keepassxc

< 2.8.0-beta1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43 github.com: https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfeb github.com: https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0-beta1