CVE-2026-42483: 
NixOS vulnerability analysis and mitigation

CVE-2026-42483 is a heap-based buffer overflow vulnerability in the Kerberos hash parser of hashcat v7.1.2 that can allow an attacker to cause a denial of service or potentially execute arbitrary code via a crafted Kerberos hash file. The flaw exists in the module_hash_decode function across 12 Kerberos-related modules, where account_info_len is calculated from untrusted delimiter positions without upper-bound validation before a memcpy copies data into a fixed-size account_info buffer. It was publicly disclosed on May 1, 2026, following a 7-day disclosure window after findings were confirmed on April 10, 2026. The vulnerability affects hashcat v7.1.2 specifically and carries a CVSS v3.1 base score of 9.8 (Critical), though this score has been disputed by community members as unjustified (sgInnora Gist, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow). In the affected Kerberos modules (13100, 18200, 19600, 19700, 19800, 19900, 28800, 28900, 32100, 32200, 35300, 35400), account_info_len is computed as the distance between two delimiter characters in user-supplied input — account_info_stop - account_info_start — with no maximum length check applied before the value is passed directly to memcpy into the fixed-size account_info buffer within the krb5tgs struct. Unlike the related stack overflow in Finding 1, the Kerberos heap overflow is not hex-constrained, meaning the attacker has broader control over the bytes written (subject only to delimiter and line-parsing constraints). Exploitation requires the victim to load a crafted Kerberos hash file into hashcat; the suggested fix is to add a bounds check: if (account_info_len > sizeof(krb5tgs->account_info)) return PARSER_TOKEN_LENGTH; (sgInnora Gist).

Successful exploitation could allow an attacker to crash the hashcat process (denial of service) or, in a more severe scenario, execute arbitrary code with the privileges of the invoking user, as hashcat runs without sandboxing. Because the overflow content is not hex-constrained (unlike the related rule engine bug), an attacker has greater control over heap memory, increasing the feasibility of code execution beyond a simple crash. The practical impact is limited to environments where untrusted Kerberos hash files are processed, such as penetration testing pipelines or automated cracking workflows that ingest externally sourced hash data (sgInnora Gist, Feedly).

No confirmed working exploit or in-the-wild exploitation has been observed. A vulnerability analysis document published on GitHub (sgInnora) describes the bug with ASAN confirmation and conceptual trigger conditions but does not provide runnable exploit code or concrete attack artifacts; Feedly's analysis classifies it as non-exploitable in its current form. The EPSS score is 0.00079, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Community members, including hashcat contributors, have disputed the Critical CVSS rating and noted that the underlying issues were addressed prior to public reporting, though the relevant PR (#4618) remained unmerged as of April 17, 2026 (sgInnora Gist, Feedly).

1. Craft a malicious Kerberos hash file: Create a hash file targeting one of the 12 affected Kerberos modules (e.g., mode 13100 for TGS-REP). Modify the account_info field within the hash line so that the data between the relevant delimiters exceeds the fixed size of the account_info buffer in the krb5tgs struct.
2. Deliver the hash file to the target: Social-engineer or otherwise cause the victim to use the crafted hash file as input to hashcat (e.g., by supplying it as part of a shared cracking job, a repository of captured hashes, or an automated pipeline).
3. Trigger parsing: The victim runs hashcat against the crafted file using an affected Kerberos module, e.g., hashcat -m 13100 crafted_krb5.txt wordlist.txt. The module_hash_decode function computes account_info_len from delimiter positions in the attacker-controlled input without an upper-bound check.
4. Heap overflow occurs: memcpy copies the oversized account_info data into the fixed-size buffer, overflowing adjacent heap memory. Depending on heap layout and platform mitigations, this results in a crash (DoS) or, theoretically, arbitrary code execution as the invoking user (sgInnora Gist).

• Process: Unexpected crash or abnormal termination of the hashcat process when processing Kerberos hash files; ASAN or similar sanitizer output referencing heap-buffer-overflow in module_hash_decode or Kerberos-related modules.
• File System: Presence of unusually large or malformed Kerberos hash files (e.g., hash lines with account_info fields far exceeding typical lengths) in directories used as hashcat input.
• Logs: Core dump files generated by hashcat crashes; system logs (e.g., /var/log/syslog) recording segmentation faults from the hashcat process when processing Kerberos mode hashes.

No official patched release of hashcat has been confirmed as of the disclosure date. Users should validate and sanitize all Kerberos hash input files before processing, rejecting lines where the account_info field exceeds expected bounds. Access to hashcat processing should be restricted to trusted, internally generated hash files only, and hashcat should be run with minimal necessary privileges. Monitor for unusual crash behavior from hashcat processes. The community-contributed PR #4618 addresses the related rule engine issue (Finding 1) but was unmerged as of April 17, 2026; users should track the hashcat GitHub repository for patches addressing the Kerberos parser (Finding 3) (sgInnora Gist).

Community member 0xVavaldi commented on the GitHub gist disputing the severity, stating that all findings were addressed prior to reporting and had not been merged due to negligible risk, and that the CVSS 9.8 score is "unjustified." Hashcat contributor @Chick3nman opened PR #4618 in January 2026 to address the related rule engine overflow (Finding 1), and community members @PenguinKeeper7 and @Chick3nman provided exploitability context in the public GitHub issue thread. A blog post on hackingpassion.com covered the findings, and Tenable published a Nessus detection plugin (ID 311725) for the vulnerability (sgInnora Gist, Tenable Nessus).