A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When data_type_enum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation.
References
| Link | Resource |
|---|---|
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | Exploit Mitigation Third Party Advisory |
| https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f | Exploit Mitigation Third Party Advisory |
Configurations
History
01 May 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f - Exploit, Mitigation, Third Party Advisory |
01 May 2026, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/sgInnora/107f2eb20367e47d58c911e38d56a91f - Exploit, Mitigation, Third Party Advisory | |
| CPE | cpe:2.3:a:hashcat:hashcat:7.1.2:*:*:*:*:*:*:* | |
| CWE | CWE-787 | |
| First Time |
Hashcat hashcat
Hashcat |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
01 May 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 14:16
Updated : 2026-05-01 19:16
NVD link : CVE-2026-42484
Mitre link : CVE-2026-42484
CVE.ORG link : CVE-2026-42484
JSON object : View
Products Affected
hashcat
- hashcat
CWE
CWE-787
Out-of-bounds Write