{"id":"CVE-2026-118673","aliases":[],"cve":{"records":[{"id":"CVE-2026-118673","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T17:25:37.562Z","published":"2026-10-29T16:01:55.635Z","modified":"2026-10-29T16:01:55.635Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T16:01:55.635Z"}],"references":[{"url":"https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/keepassxreboot/keepassxc/pull/13679","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-787","description":"CWE-787: Out-of-bounds Write","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.","score":4.1,"severity":"medium","published":"2026-10-29T16:01:55.635Z","modified":"2026-10-29T16:01:55.635Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"keepassxreboot","name":"keepassxc","platforms":[],"versions":[{"version":">= 2.3.0, < 2.8.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118673"}],"remediation":[],"references":["https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227","https://github.com/keepassxreboot/keepassxc/pull/13679","https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa","https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0"],"sources":[{"name":"CVE","id":"CVE-2026-118673","modified":"2026-10-29T16:01:55.635Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118673"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":4.1}],"sourceAffected":[],"observedAt":"2026-10-29T17:05:37.603Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"KeePassXC versions 2.3.0 to 2.7.9 have an out-of-bounds write weakness in browser integration response encryption. A local attacker with access to the IPC endpoint and a valid database association can trigger this issue. The impact is an out-of-bounds write before any response is delivered.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:02:05.399Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118673"}]}}