CVE-2026-86776 — KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file…
Published: 2026-09-09 · CVSS: 4.6 · CVSS 4.0
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7