CVE-2026-42483 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-42483 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42483 is a heap-based buffer overflow vulnerability in the Kerberos hash parser component of Hashcat v7.1.2, a widely used open-source password recovery tool.

Technical Detail

The flaw exists in Hashcat's parsing logic for Kerberos hash files, where insufficient bounds checking on heap-allocated memory allows a specially crafted input file to trigger a buffer overflow condition. An attacker can exploit this by supplying a malformed Kerberos hash file to the application, causing memory corruption that may result in a denial of service or, under favorable conditions, arbitrary code execution. The severity of the impact depends on the execution context, but the CVSS score of 9.8 reflects the potential for full code execution without authentication requirements on the parsing operation itself.

Exploitation Status

No known exploit exists for this vulnerability at this time. The exploit maturity is currently assessed as none, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. This does not preclude the possibility of private exploitation, but no public proof-of-concept or operational exploit has been confirmed as of May 08, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence.

What To Do

Users running Hashcat v7.1.2 should check for an updated release from the Hashcat project that addresses this parsing flaw and apply it promptly given the critical CVSS rating. As an interim measure, operators should avoid processing untrusted or externally sourced Kerberos hash files until a patch is confirmed applied. Organizations running Hashcat in automated pipelines or shared environments should treat this with elevated priority due to the potential for code execution. Monitor the official Hashcat GitHub repository and security advisories for patch availability and release notes confirming the fix.