CVE-2026-42484 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-42484 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42484 is a heap-based buffer overflow vulnerability in the PKZIP hash parser component of Hashcat v7.1.2, specifically within the hex_to_binary function.

Technical Detail

The flaw exists in how Hashcat's PKZIP hash parser processes input data through the hex_to_binary function, where insufficient bounds checking allows a crafted PKZIP hash file to overflow a heap-allocated buffer. An attacker can trigger this condition by supplying a malformed PKZIP hash file as input to the application, either directly or by convincing a user to process attacker-controlled hash data. Successful exploitation can result in a denial of service through application crash or, in more severe cases, arbitrary code execution in the context of the running process.

Exploitation Status

No known exploit exists for this vulnerability at this time. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been confirmed. The vulnerability remains theoretical in terms of active exploitation, though the critical CVSS score of 9.8 reflects the potential severity if exploitation were achieved.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability as of the date of this briefing.

What To Do

Organizations and individuals running Hashcat v7.1.2 should monitor the official Hashcat project repository for a patched release and apply it promptly given the critical severity rating. As an interim measure, restrict the processing of PKZIP hash files to trusted, internally generated sources only, and avoid running Hashcat against hash files obtained from untrusted or external parties. Security teams should treat any unexpected Hashcat process crashes as a potential indicator of exploitation attempts and review associated input files. Given the tool's typical use in password auditing and penetration testing environments, exposure is generally limited to security practitioners, but any automated pipeline ingesting external hash files should be reviewed for exposure to this attack vector.