CVE-2026-42482 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-42482 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42482 is a stack-based buffer overflow vulnerability in Hashcat v7.1.2, specifically within the mangle_to_hex_lower() and mangle_to_hex_upper() functions located in src/rp_cpu.c.

Technical Detail

The flaw exists in the rule-processing CPU code of Hashcat, where insufficient bounds checking in the hex mangling functions allows a stack-based buffer overflow condition to be triggered via crafted input. An attacker who can supply malicious rule strings or input data to the affected functions may overwrite stack memory, leading to either a denial of service through application crash or, under favorable conditions, arbitrary code execution. Given the nature of stack-based overflows and the CVSS score of 9.8, the worst-case impact is unauthenticated remote code execution, though the practical attack surface depends on how Hashcat is deployed and whether attacker-controlled input reaches the vulnerable functions.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as none, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept code has been confirmed as of May 8, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence.

What To Do

Organizations and individuals running Hashcat v7.1.2 should monitor the official Hashcat project repository for a patched release and apply it as soon as one becomes available. In the interim, restrict the use of Hashcat to trusted, controlled environments and avoid processing untrusted or externally supplied rule files or input data. If Hashcat is deployed in any automated pipeline that accepts external input, consider suspending that functionality until a fix is confirmed. Given the critical CVSS score, patch prioritization should be treated as high even in the absence of confirmed active exploitation.