CVE-2026-42484 Memory corruption in n/a
A heap-based buffer overflow in hashcat allows attackers to execute arbitrary code or cause denial of service via crafted PKZIP hash files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42484?
CVE-2026-42484 is a critical memory corruption vulnerability in n/a, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A heap-based buffer overflow in hex_to_binary in the PKZIP hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted PKZIP hash file. The issue affects modules 17200, 17210, 17220, 17225, and 17230. When data_type_enum<=1, attacker-controlled hex data from a user-supplied hash string is decoded into a fixed-size buffer without proper input-length validation.
Weakness: CWE-787
Which versions are affected by CVE-2026-42484?
It affects 1 product.
Products include Hashcat Hashcat.
How do I fix CVE-2026-42484?
No fix has been published for CVE-2026-42484 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42484 exists.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2026-42484, GHSA-v498-cj6g-8848, UBUNTU-CVE-2026-42484.