KeePassXC 2.8.0 fixes eight security flaws including use-after-free CVE-2026-69150 in KDB import
KeePassXC released version 2.8.0 on October 21, with eight security fixes, platform improvements and a migration to Qt 6. One flaw has an assigned identifier, CVE-2026-69150, a use-after-free triggered when importing specially crafted KDB files. Four more issues are marked CVE-PENDING. The changelog gives no severity scores, exploitation prerequisites or evidence of active exploitation, so the memory corruption bugs should not be assumed to be confirmed remote code execution.
Entenda a falha
A vulnerabilidade
KeePassXC before 2.8.0 has eight security fixes. The only one with a CVE is CVE-2026-69150, a use-after-free in the legacy KDB import path, triggered by importing a specially crafted KDB file. Four more issues are marked CVE-PENDING: an integer overflow and out-of-bounds read in the KDB importer, entry reference injection via the browser extension, out-of-bounds writes in native messaging encryption and decryption, and predictable shared memory names used to pass SSH keys to Pageant on Windows. The changelog gives no severity scores, prerequisites or evidence of exploitation, so remote code execution should not be assumed. All are fixed in 2.8.0.
Como funciona
For CVE-2026-69150, a user opens a legacy KDB database through the import function and the importer parses the file's contents into memory structures. With a crafted file, the importer ends up using memory after it has been freed. The articles do not describe the exact step where this happens. The related KDB bugs, an integer overflow and an out-of-bounds read, occur in the same parsing stage.
Por que é vulnerável
CVE-2026-69150 is a memory-lifetime error in the legacy KDB importer: memory is used after being freed while processing untrusted file data. The articles describe the other importer bugs only as unsafe memory operations during database processing, and give no deeper root cause or reason why they went unnoticed. The fix is shipped in 2.8.0, but the articles do not describe the code change.
Como foi descoberta
The flaws were reported by outside researchers credited in the 2.8.0 release notes. A. Ramos is credited for CVE-2026-69150. Viktor Markopoulos (NATO Cyber Security Center) is credited for the KDB integer overflow and out-of-bounds read and for the Pageant shared memory issue. Davonte (BadPingHere) is credited for the entry reference injection, and sigure21 for the native messaging out-of-bounds writes. The articles do not say how the researchers found the flaws or when they reported them. They became public through the KeePassXC release on October 21.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 09:16.
Detalhes técnicos
- CVE-2026-69150: use-after-free in the legacy KDB import path, credited to A. Ramos.
- Integer overflow and out-of-bounds read in the legacy KDB importer, reported by Viktor Markopoulos (NATO Cyber Security Center).
- Entry reference injection when the browser extension creates or updates entries, reported by Davonte (BadPingHere). CVE pending.
- Out-of-bounds writes during encryption and decryption of native messaging messages, credited to sigure21. CVE pending.
- On Windows, shared memory mapping names used to transfer SSH keys to Pageant are now randomized, also credited to Markopoulos. CVE pending.
- Hardening: the Windows clipboard exclusion format name was corrected (ByeWhiteLists). Protected attributes are excluded from Secret Service listings (Koda Reef). Decrypted database fragments in zlib memory are now cleared better.
- Non-security changes include remote database synchronization, Wayland Auto-Type, Polkit Quick Unlock, native Windows Arm64 builds, Group Policy overrides and RSA/ECDSA/Ed25519 key generation.
Remediação
Upgrade to KeePassXC 2.8.0, prioritizing installations that use legacy KDB imports, browser integration or Pageant workflows. The release notes list no interim workarounds.
Linha do tempo
-
KeePassXC 2.8.0 fixes eight security flaws including use-after-free CVE-2026-69150 in KDB import
ler a análise desta fonte ocultar
KeePassXC released version 2.8.0 on October 21, with eight security fixes, platform improvements and a migration to Qt 6. One flaw has an assigned identifier, CVE-2026-69150, a use-after-free triggered when importing specially crafted KDB files. Four more issues are marked CVE-PENDING. The changelog gives no severity scores, exploitation prerequisites or evidence of active exploitation, so the memory corruption bugs should not be assumed to be confirmed remote code execution.
Technical Details
- CVE-2026-69150: use-after-free in the legacy KDB import path, credited to A. Ramos.
- Integer overflow and out-of-bounds read in the legacy KDB importer, reported by Viktor Markopoulos (NATO Cyber Security Center).
- Entry reference injection when the browser extension creates or updates entries, reported by Davonte (BadPingHere). CVE pending.
- Out-of-bounds writes during encryption and decryption of native messaging messages, credited to sigure21. CVE pending.
- On Windows, shared memory mapping names used to transfer SSH keys to Pageant are now randomized, also credited to Markopoulos. CVE pending.
- Hardening: the Windows clipboard exclusion format name was corrected (ByeWhiteLists). Protected attributes are excluded from Secret Service listings (Koda Reef). Decrypted database fragments in zlib memory are now cleared better.
- Non-security changes include remote database synchronization, Wayland Auto-Type, Polkit Quick Unlock, native Windows Arm64 builds, Group Policy overrides and RSA/ECDSA/Ed25519 key generation.
Remediation
Upgrade to KeePassXC 2.8.0, prioritizing installations that use legacy KDB imports, browser integration or Pageant workflows. The release notes list no interim workarounds.