Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-42483 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-01 |
| Vendor | Hashcat |
| Product | Hashcat |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause a denial of service or possibly execute arbitrary code via a crafted Kerberos hash file. The issue affects module_hash_decode in multiple Kerberos-related modules because account_info_len is calculated from untrusted delimiter positions without upper-bound validation before memcpy copies the data into a fixed-size account_info buffer.
Required Actions
Update hashcat to a release newer than 7.1.2 that contains the fix. Until updated, do not load Kerberos hash files from untrusted sources. In pentest/forensic workflows, consider running hashcat in an isolated environment (container, VM) with reduced privileges to limit the impact of potential code execution.
Who Is Affected?
This vulnerability affects Hashcat by the Hashcat project. Check whether your organization uses hashcat to process Kerberos hashes and roll out the update.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
