Heap Use-After-Free Vulnerability in KeePassXC by Keepass

CVE-2026-69150

What is CVE-2026-69150?

KeePassXC, a community-driven cross-platform password manager, is susceptible to a heap use-after-free vulnerability which occurs prior to version 2.8.0-beta1. This vulnerability arises during the import process of certain crafted .kdb files. Specifically, the application retains obsolete Entry pointers within its metadata after deleting specific entries, which can lead to a crash when these stale pointers are accessed. An attacker could exploit this flaw to cause a controlled write and ultimately crash the process, presenting potential risks to user data security. The issue has been resolved in version 2.8.0-beta1.

References