Live › vulnerability › CVE-2026-118673
KeePassXC's browser integration writes encrypted responses into a fixed 1 MiB buffer without checking the size, so an oversized response overflows it. A local browser-protocol client with a valid database association can trigger an out-of-bounds write that may let it affect the running password manager.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Only installations of KeePassXC from 2.3.0 to before 2.8.0 with browser integration in use are exposed, and only when a browser-protocol client on the same user account has a valid database association and an unlocked database produces a large authorized response. Systems without browser integration, or running 2.8.0 or later, can skip it.
No product ranges from the sources yet.
keepassxc --version); versions from 2.3.0 up to but not including 2.8.0 are affected2.8.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118673")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.