CVE-2026-42483 is a heap based buffer overflow in the Kerberos hash parser of hashcat v7.1.2, scored CVSS 9.8. A crafted Kerberos hash file can cause a crash or possibly code execution. Load only hash files you trust and check for a newer hashcat release.
What's affected
The NVD record names hashcat v7.1.2. The flaw is in module_hash_decode across several Kerberos related modules. The length of the account information field is derived from delimiter positions in the file, with no upper limit check before the data is copied into a fixed size buffer.
The record does not name a fixed version, and the only reference is a researcher write up that I did not retrieve. Check the hashcat release notes and issue tracker for a release newer than 7.1.2 before assuming you are covered.
How to check if you're exposed
- Run hashcat --version and note the number.
- If it reports v7.1.2, treat it as affected until the project says otherwise.
- Think about where your input files come from. The trigger is a crafted file or option, so the question is whether anyone untrusted can supply it, for example through a shared hash upload folder, a web front end that wraps hashcat, or a rule file you downloaded.
What to do now
- Check the hashcat release page for a version newer than 7.1.2 and upgrade when one is available.
- Until then, only process hash files and rule files that you created or have verified.
- If you run hashcat behind a service that accepts uploads, validate and size limit the input before it reaches hashcat, and run it in a container or low privilege account.
- Keep cracking workstations off networks that hold production secrets.
Why it matters
The weakness classes are CWE-122, a heap based overflow, and CWE-787, an out of bounds write. The parser trusts a length it computed from untrusted data. Checking that length against the buffer size before copying is the standard fix.
The CVSS vector says network attack with no privileges, which gives a 9.8. In practice hashcat is usually a local tool, so exposure depends on who can hand it a file. Wrappers and shared cracking rigs are the places that deserve attention. The KEV flag is false and I found no report of exploitation in the wild.
Quick check
Which hashcat modules are involved?
The record says multiple Kerberos related modules that share module_hash_decode. It does not list them individually.
Sources
Last reviewed: 19 October 2026.
