Stack-Based Buffer Overflow in Hashcat v7.1.2 by Hashcat Team

CVE-2026-42482

What is CVE-2026-42482?

A stack-based buffer overflow vulnerability exists in Hashcat v7.1.2, specifically within the mangle_to_hex_lower() and mangle_to_hex_upper() functions found in src/rp_cpu.c. Exploitation can occur when an attacker crafts a specific rule file or utilizes the -j or -k rule options with password candidates that contain 128 or more characters. The vulnerability stems from an insufficient bounds check that fails to accommodate the twofold expansion when transforming password bytes into hexadecimal format, potentially resulting in a denial of service or the execution of arbitrary code.

References