CVE-2026-68767
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly th
CVSS
6.1
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 22, 2026 · Last modified: Aug 22, 2026 · CWE-193
Not enough EPSS history yet.
hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.
- github.comhttps://github.com/hashcat/hashcat
- github.comhttps://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060
- github.comhttps://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249
- github.comhttps://github.com/hashcat/hashcat/issues/4739
- www.vulncheck.comhttps://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-633877.0 HIG28.2%
——8Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.2dCVE-2026-555645.4 MED30.2%
——9FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, the glyph_cache_get function in libfreerdp/cache/glyph.c checks whether index is greater than cache->number instead of greater than or equal to it. A malicious RDP server can use GLYPH_FRAGMENT_USE replay in update_process_glyph_fragments to make the default cache receive index 254 when cache->number is 254, reading one pointer beyond the entries array and dereferencing it as a glyph. This can crash the client and may disclose adjacent heap data. This issue is fixed in version 3.27.0.3dCVE-2026-668065.5 MED35.0%
——11Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.8dCVE-2026-71391—25.7%
——8GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than comparison instead of greater-than-or-equal, allowing a crafted TrueType variable font to bypass the check and trigger a heap-based out-of-bounds read via memcpy. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This exposes heap memory contents which can be later used to defeat ASLR.
This issue was fixed in commit 95ab9ef627b212d74d321c5bbb5b56a1be7b9fbe12dCVE-2026-117717.5 HIG30.8%
——9OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server17dCVE-2026-148997.5 HIG19.9%
——6The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.11d