CVE-2026-86776
KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
| CWE | CWE-789 |
| Vendor | keepass |
| Product | keepass |
| Published | Sep 9, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for keepass keepass
Be the first to know when new low vulnerabilities affecting keepass keepass are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
KeePass / KeePass
2.35 ≤ 2.61.1
References
Credits
KSecur1ty