Vulnerability · Published Oct 29, 2026 · Assigned by GitHub_M

CVE-2026-118673KeePassXC: Out-of-bounds write in browser integration response encryption with oversized database responses

Medium 4.1

In plain English

A medium-severity out-of-bounds write in keepassxc from keepassxreboot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.1Medium

Exploit odds (30 days)0.1%top 98.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	keepassxc	no fix listed	DEBIAN-CVE-2026-118673
Debian:13	keepassxc	no fix listed	DEBIAN-CVE-2026-118673
Debian:14	keepassxc	2.8.0+dfsg1-1	DEBIAN-CVE-2026-118673
Ubuntu:22.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-118673
Ubuntu:24.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-118673
Ubuntu:26.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-118673
Ubuntu:26.10	keepassxc	no fix listed	UBUNTU-CVE-2026-118673

Affected products (as reported)

Vendor	Product	Versions
keepassxreboot	keepassxc	>= 2.3.0, < 2.8.0

Weakness: CWE-787 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227 x_refsource_CONFIRM
https://github.com/keepassxreboot/keepassxc/pull/13679 x_refsource_MISC
https://github.com/keepassxreboot/keepassxc/commit/80e68bb4e8b89e383dd96b1bf5de169ca61367aa x_refsource_MISC
https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0 x_refsource_MISC