CVE-2026-42484 is a heap based buffer overflow in the PKZIP hash parser of hashcat v7.1.2, scored CVSS 9.8. A crafted PKZIP hash file can cause a crash or possibly code execution. It affects modules 17200, 17210, 17220, 17225 and 17230. Use only trusted hash files and watch for a fix.
What's affected
The NVD record names hashcat v7.1.2. The flaw is in hex_to_binary for the PKZIP modules 17200, 17210, 17220, 17225 and 17230. When data_type_enum is 1 or lower, hex data from the user supplied hash string is decoded into a fixed size buffer without checking its length.
The record does not name a fixed version, and the only reference is a researcher write up that I did not retrieve. Check the hashcat release notes and issue tracker for a release newer than 7.1.2 before assuming you are covered.
How to check if you're exposed
- Run hashcat --version and note the number.
- If it reports v7.1.2, treat it as affected until the project says otherwise.
- Think about where your input files come from. The trigger is a crafted file or option, so the question is whether anyone untrusted can supply it, for example through a shared hash upload folder, a web front end that wraps hashcat, or a rule file you downloaded.
What to do now
- Check the hashcat release page for a version newer than 7.1.2 and upgrade when one is available.
- Until then, only process hash files and rule files that you created or have verified.
- If you run hashcat behind a service that accepts uploads, validate and size limit the input before it reaches hashcat, and run it in a container or low privilege account.
- Keep cracking workstations off networks that hold production secrets.
Why it matters
The weakness is CWE-787, an out of bounds write. Input from a hash string is decoded into a buffer whose size is not compared with the input length. The fix pattern is to reject or truncate oversize input before decoding.
The CVSS vector says network attack with no privileges, which gives a 9.8. In practice hashcat is usually a local tool, so exposure depends on who can hand it a file. Wrappers and shared cracking rigs are the places that deserve attention. The KEV flag is false and I found no report of exploitation in the wild.
Quick check
Does this affect all hashcat modes?
No. The record limits it to the PKZIP modules 17200, 17210, 17220, 17225 and 17230.
Sources
Last reviewed: 19 October 2026.
