CVE-2026-4158: 
KeePassXC vulnerability analysis and mitigation

CVE-2026-4158 is a local privilege escalation vulnerability in KeePassXC caused by an uncontrolled search path element in its OpenSSL configuration loading. Discovered by Xavier DANEST working with TrendAI's Zero Day Initiative (ZDI), the vulnerability was reported to the vendor on March 3, 2026, and publicly disclosed on March 16, 2026. It affects KeePassXC versions 2.7.11 and earlier (tested on Windows 11 Enterprise 24H2), and was patched in version 2.7.12. The CVSS v3 base score is 7.3 (High) (ZDI Advisory, GitHub Advisory).

The root cause is CWE-427 (Uncontrolled Search Path Element): when KeePassXC checks for updates, it initializes OpenSSL via OPENSSL_init_crypto, which calls OPENSSL_config and attempts to load a configuration file from a hardcoded, user-writable path — specifically C:\Tools\vcpkg\packages\openssl_x64-windows\openssl.cnf on Windows. Because this directory path is not restricted to privileged users, a low-privileged attacker can create the folder structure and place a malicious openssl.cnf alongside a crafted DLL. When OpenSSL processes the configuration file, it loads the attacker-controlled DLL into the KeePassXC process of any user who subsequently runs the application and triggers an update check. The call chain runs through libcrypto-3-x64.dll → CONF_modules_load_file_ex → BIO_new_file, as confirmed by the detailed stack trace in the advisory (GitHub Advisory, ZDI Advisory).

Successful exploitation allows a local attacker to execute arbitrary code within the security context of another user's KeePassXC process, resulting in high confidentiality, integrity, and availability impact. Because KeePassXC manages sensitive password databases, code execution within its process context could expose all stored credentials and secrets of the targeted user. The attack does not require elevated privileges to set up, but achieves effective privilege escalation by hijacking a higher-privileged user's application session (ZDI Advisory, GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available — the ZDI advisory describes the vulnerability without providing actionable attack artifacts (ZDI Advisory). The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (the target user must run KeePassXC and trigger an update check), limiting its practical attack surface.

1. Gain local access: Obtain the ability to execute low-privileged code on the target Windows system (e.g., via phishing, existing foothold, or shared workstation access).
2. Create the malicious directory structure: At a command prompt, run mkdir C:\Tools\vcpkg\packages\openssl_x64-windows to create the path that KeePassXC's bundled OpenSSL will search for its configuration file.
3. Craft a malicious DLL: Compile a DLL (e.g., CmdOnDllMain.dll) that executes a payload (such as spawning a reverse shell or exfiltrating data) from its DllMain entry point.
4. Prepare the OpenSSL configuration file: Create an openssl.cnf file that references the malicious DLL as an OpenSSL engine or module, and place both openssl.cnf and the malicious DLL in C:\Tools\vcpkg\packages\openssl_x64-windows\.
5. Wait for target user interaction: When any user on the machine launches KeePassXC and triggers an update check (e.g., via the Help menu), OpenSSL initializes, reads the attacker-controlled openssl.cnf, and loads the malicious DLL into the KeePassXC process.
6. Achieve code execution: The DLL executes within the KeePassXC process of the target user, granting the attacker arbitrary code execution in that user's security context and access to all secrets stored in their KeePass database (GitHub Advisory, ZDI Advisory).

• File System: Presence of the directory C:\Tools\vcpkg\packages\openssl_x64-windows\ created by a non-administrative user; existence of openssl.cnf or unexpected DLL files (e.g., CmdOnDllMain.dll) in that path.
• Process: Unexpected child processes spawned by KeePassXC.exe (e.g., cmd.exe, powershell.exe, network tools) at the time of an update check; unusual DLLs loaded into the KeePassXC process not originating from C:\Program Files\KeePassXC\.
• Logs: Windows file system audit logs showing CreateFile operations by KeePassXC.exe (PID associated with the application) targeting C:\Tools\vcpkg\packages\openssl_x64-windows\openssl.cnf; Process Monitor or Sysmon events recording DLL load events from user-writable paths into KeePassXC.exe.
• Network: Unexpected outbound connections from KeePassXC.exe to external IPs not associated with KeePassXC update servers, particularly shortly after an update check is triggered (GitHub Advisory).

KeePassXC has released version 2.7.12 to address this vulnerability; all users running version 2.7.11 or earlier should upgrade immediately (GitHub Advisory). As a workaround, administrators can restrict file system permissions on the C:\Tools\ directory tree to prevent low-privileged users from creating or modifying files in paths that KeePassXC's OpenSSL component searches. Additionally, disabling automatic update checks in KeePassXC can reduce the attack surface by preventing the vulnerable OpenSSL initialization code path from being triggered (ZDI Advisory).

The vulnerability was credited to researcher Xavier DANEST working through TrendAI's Zero Day Initiative, which coordinated disclosure with the KeePassXC team (ZDI Advisory). The KeePassXC maintainer (phoerious) published the security advisory on GitHub on March 9, 2026, rating it as "Moderate" severity, and a patch was released promptly (GitHub Advisory). Coverage was picked up by security aggregators including VulDB, SystemTek, and INCIBE-CERT, though no significant broader media or social media discussion has been identified.