CVE-2026-86776CWE-789

CVE-2026-86776

Low · published September 9, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
4.6 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00168 · 5.7th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-09-09T14:22Z
References (4)
https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC · [email protected]https://keepass.info/ · [email protected]https://keepass.info/download.html · [email protected]https://www.vulncheck.com/advisories/keepass-2.35-through-2.61.1-memory-exhaustion-via-kdbx-header-field-size · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 10:07Z
    KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size
    cvelistv5