---
id: CVE-2026-68767
title: >-
  hashcat's fgetl() function in src/filehandling.c writes a null terminator one
  byte past the caller's buffer when an input line is exactly the buffer length
summary: >-
  hashcat's fgetl() function in src/filehandling.c writes a null terminator one
  byte past the caller's buffer when an input line is exactly the buffer length.
  Attackers can trigger this out-of-bounds heap write by providing a hash file,
  po…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cwe:
  - CWE-193
published: '2026-08-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68767'
references:
  - url: 'https://github.com/hashcat/hashcat'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hashcat/hashcat/blob/v7.1.2/src/filehandling.c#L1032-L1060
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/hashcat/hashcat/commit/93b55d37d3b2340013d4036f10181ddc67d44249
    label: disclosure@vulncheck.com
  - url: 'https://github.com/hashcat/hashcat/issues/4739'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hashcat-through-off-by-one-out-of-bounds-heap-write-in-fgetl
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00172
epssPercentile: 0.05836
ingestedAt: '2026-08-23T04:42:15.506Z'
---

## Overview

hashcat's fgetl() function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.