CVE-2026-69150 KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map
A crafted KDB file triggers a heap use-after-free in KeePassXC, allowing attackers to cause a crash or potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-69150?
CVE-2026-69150 is a medium-severity use after free vulnerability in keepassxreboot keepassxc, published on 13 Oct 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.
Weakness: CWE-416
Which versions are affected by CVE-2026-69150?
How do I fix CVE-2026-69150?
No fix has been published for CVE-2026-69150 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-69150 being exploited?
There is no known exploitation of CVE-2026-69150 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-69150, GHSA-4642-49vv-4p43, UBUNTU-CVE-2026-69150.