Stack Buffer Overflow in NTLM Authentication for Hydra by THC

CVE-2026-56766

What is CVE-2026-56766?

Hydra versions up to 9.7 contain a stack buffer overflow vulnerability in the NTLM authentication handler. This occurs when processing malicious NTLM Type-2 challenges across various protocols including SMTP, POP3, IMAP, and HTTP. An attacker can exploit this vulnerability by sending a crafted NTLM Type-2 challenge featuring an excessively long domain string, which can overflow a 500-byte stack buffer by an alarming amount, facilitating remote code execution on systems lacking stack protection measures. Users are advised to apply the patch available in commit 9cc84c2 to mitigate this risk.

References