CVE-2026-42482 is a stack based buffer overflow in hashcat v7.1.2, scored CVSS 9.8. The hex conversion rule functions do not allow for output doubling in size, so a crafted rule file or long password candidates can crash the tool or possibly run code. Use only trusted rules and look for a newer release.
What's affected
The NVD record names hashcat v7.1.2. The flaw sits in mangle_to_hex_lower and mangle_to_hex_upper in src/rp_cpu.c. It can be reached through a crafted rule file, or through the -j or -k rule options used with password candidates of 128 characters or more.
The record does not name a fixed version, and the only reference is a researcher write up that I did not retrieve. Check the hashcat release notes and issue tracker for a release newer than 7.1.2 before assuming you are covered.
How to check if you're exposed
- Run hashcat --version and note the number.
- If it reports v7.1.2, treat it as affected until the project says otherwise.
- Think about where your input files come from. The trigger is a crafted file or option, so the question is whether anyone untrusted can supply it, for example through a shared hash upload folder, a web front end that wraps hashcat, or a rule file you downloaded.
What to do now
- Check the hashcat release page for a version newer than 7.1.2 and upgrade when one is available.
- Until then, only process hash files and rule files that you created or have verified.
- If you run hashcat behind a service that accepts uploads, validate and size limit the input before it reaches hashcat, and run it in a container or low privilege account.
- Keep cracking workstations off networks that hold production secrets.
Why it matters
The weakness classes are CWE-121, a stack based overflow, and CWE-787, an out of bounds write. The bounds check compared against the input length, but converting bytes to hexadecimal doubles the length, so the result can be larger than the buffer. It is a classic size calculation mistake.
The CVSS vector says network attack with no privileges, which gives a 9.8. In practice hashcat is usually a local tool, so exposure depends on who can hand it a file. Wrappers and shared cracking rigs are the places that deserve attention. The KEV flag is false and I found no report of exploitation in the wild.
Quick check
Which inputs trigger it?
Per the record, a crafted rule file, or the -j and -k rule options combined with password candidates of 128 or more characters.
Sources
Last reviewed: 19 October 2026.
