Vulnerability · Published Apr 11, 2026 · Assigned by zdi

CVE-2026-4158KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

High 7.3

In plain English

A high-severity uncontrolled search path in KeePassXC from KeePassXC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.0)7.3High

Exploit odds (30 days)0.2%top 86.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

KeePassXC OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of KeePassXC. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads configuration from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of KeePassXC when run by a target user on the system. Was ZDI-CAN-29156.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-4158
Ubuntu:24.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-4158
Ubuntu:25.10	keepassxc	no fix listed	UBUNTU-CVE-2026-4158
Ubuntu:26.04:LTS	keepassxc	no fix listed	UBUNTU-CVE-2026-4158
Ubuntu:26.10	keepassxc	no fix listed	UBUNTU-CVE-2026-4158

Affected products (as reported)

Vendor	Product	Versions
KeePassXC	KeePassXC	2.7.11

Weakness: CWE-427 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ZDI-26-215 x_research-advisory
vendor-provided URL vendor-advisory