{"id":"CVE-2026-86776","title":"KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function","summary":"KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocat…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cwe":["CWE-789"],"vendor":"KeePass","product":"KeePass","affected":["KeePass >= 2.35 <= 2.61.1"],"published":"2026-09-09","updated":"2026-09-10","sourceUpdated":"2026-09-10T19:58:20.507","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86776","references":[{"url":"https://github.com/KSecur1ty/KDBX-Header-Size-Mirage-POC","label":"disclosure@vulncheck.com"},{"url":"https://keepass.info/","label":"disclosure@vulncheck.com"},{"url":"https://keepass.info/download.html","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/keepass-2.35-through-2.61.1-memory-exhaustion-via-kdbx-header-field-size","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T13:48:59.785045Z"},"ingestedAt":"2026-09-10T19:31:12.546Z","epss":0.00118,"epssPercentile":0.01938,"slug":"CVE-2026-86776","body":"## Overview\n\nKeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":30,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":49632,"id":"CVE-2026-86776","ts":1789055633762,"field":"exploit_available","old":"false","new":"true"}]}