CVE-2026-86776Low· 3.3▾ TwilightPoC availableKeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 18.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Exploit / PoC code exists
0.1%
0.1% → 0.2%
KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive header field lengths to trigger allocation of gigabytes of memory, causing the application to consume resources and terminate.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112283Medium· 5.5libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points
CVE-2026-112048Medium· 6.1libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
CVE-2026-111279High· 7.5Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER
CVE-2026-108683Medium· 4.3A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9
CVE-2026-107390Medium· 6.2music-metadata is a metadata parser for audio and video media files
CVE-2026-107389Medium· 6.2music-metadata is a metadata parser for audio and video media files