{"id":"CVE-2026-118673","kind":"vulnerability","aliases":["CVE-2026-118673"],"related":[],"title":"KeePassXC: browser integration heap overflow on large encrypted responses","description":"KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.","summary":"KeePassXC's browser integration writes encrypted responses into a fixed 1 MiB buffer without checking the size, so an oversized response overflows it. A local browser-protocol client with a valid database association can trigger an out-of-bounds write that may let it affect the running password manager.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser-integration","desktop","keepassxc","package","password-manager"],"not_affected_if":["browser-integration-disabled","version-2.8.0-or-later"],"how_to_check":"- Check the installed KeePassXC version (Help > About, or `keepassxc --version`); versions from 2.3.0 up to but not including 2.8.0 are affected\n- Check whether browser integration is enabled in KeePassXC settings (unknown whether this is the default)","fix":"- Move KeePassXC to `2.8.0` or later","status":"open","published_at":"2026-10-29T16:18:03+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:32:08+00:00","updated_at":"2026-10-29T16:32:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:32:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move KeePassXC to `2.8.0` or later","reach":"local","title":"KeePassXC: browser integration heap overflow on large encrypted responses","impact":"medium","summary":"KeePassXC's browser integration writes encrypted responses into a fixed 1 MiB buffer without checking the size, so an oversized response overflows it. A local browser-protocol client with a valid database association can trigger an out-of-bounds write that may let it affect the running password manager.","audience":"everyone","category":"package","nicknames":[],"who_cares":["keepassxc","password-manager","browser-integration","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local client triggers out-of-bounds write in KeePassXC process","analyst_note":"","how_to_check":"- Check the installed KeePassXC version (Help > About, or `keepassxc --version`); versions from 2.3.0 up to but not including 2.8.0 are affected\n- Check whether browser integration is enabled in KeePassXC settings (unknown whether this is the default)","plain_action":"Update KeePassXC to version 2.8.0 or later if you use its browser integration.","needs_analyst":false,"not_affected_if":["version-2.8.0-or-later","browser-integration-disabled"],"who_is_affected":"Only installations of KeePassXC from 2.3.0 to before 2.8.0 with browser integration in use are exposed, and only when a browser-protocol client on the same user account has a valid database association and an unlocked database produces a large authorized response. Systems without browser integration, or running 2.8.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4266,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118673':12A,15A '-2026':11A,14A '1':35B,108C '2.3.0':94C '2.8.0':96C,180C 'access':134C 'affect':71B 'applic':89C 'associ':58B,145C 'author':101C,158C 'botan':114C 'bound':65B,167C 'box':117C,125C 'browser':2A,17B,27B,51B,98C,129C 'browser-integr':16B 'browser-protocol':50B,128C 'buffer':37B 'caus':147C 'check':39B 'client':53B,131C 'communiti':83C 'community-driven':82C 'cross':80C 'cross-platform':79C 'crypto':116C,124C 'cve':10A,13A 'databas':57B,144C,150C 'deliv':173C 'desktop':19B 'driven':84C 'easi':118C 'encrypt':8A,30B,100C,154C 'endpoint':140C 'even':112C 'fix':34B,107C,177C 'generat':152C 'heap':4A 'integr':3A,18B,28B,99C 'ipc':139C 'issu':175C 'keepass':90C 'keepassxc':1A,20B,25B,76C,97C 'larg':7A,157C 'length':122C 'let':69B 'local':49B 'macbyt':126C 'manag':24B,75B 'may':68B 'mib':36B,109C 'out-of-bound':62B,164C 'output':110C 'overflow':5A,46B 'overs':44B 'packag':21B 'password':23B,74B,91C 'password-manag':22B 'per':137C 'per-us':136C 'plaintext':121C 'platform':81C 'plus':123C 'port':85C 'protocol':52B,130C 'respons':9A,31B,45B,102C,159C,171C 'run':73B 'safe':92C 'sequenti':163C 'size':41B 'sodium':115C 'src/browser/browsermessagebuilder.cpp':104C 'suffici':156C 'though':113C 'trigger':60B,161C 'unlock':149C 'use':105C 'user':138C 'valid':56B,143C 'vector':111C 'version':179C 'window':88C 'without':38B 'write':29B,66B,119C,168C","nicknames":[],"mitigations":[],"who_affected":"Only installations of KeePassXC from 2.3.0 to before 2.8.0 with browser integration in use are exposed, and only when a browser-protocol client on the same user account has a valid database association and an unlocked database produces a large authorized response. Systems without browser integration, or running 2.8.0 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update KeePassXC to version 2.8.0 or later if you use its browser integration.","first_public_at":"2026-10-29T16:18:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118673","severity":null,"published_at":"2026-10-29T16:18:03+00:00","modified_at":"2026-10-29T16:18:03+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}