CVE catalog

CVE-2026-86776

KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Attackers can craft a malicious KDBX file declaring excessive he

[CVE catalog]

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Sep 9, 2026, 10:07:26 AM UTC
Updated: Sep 9, 2026, 10:22:33 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.17% · Oct 25, 2026

A flaw was found in KeePass. An attacker can craft a malicious KDBX file that declares excessively large header field lengths. When a user opens this file, the application attempts to allocate gigabytes of memory, leading to resource exhaustion and causing the application to terminate. This vulnerability can result in a denial of service. Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	keepass2	bookworm	Not reported	vulnerable
Debian	keepass2	12	`2.47+dfsg-2`	vulnerable
Debian	keepass2	12	`2.57+dfsg-1`	vulnerable
Debian	keepass2	12	`2.57+dfsg-1~bpo12+1`	vulnerable
Debian	keepass2	12	`2.57+dfsg-2`	vulnerable
Debian	keepass2	12	`2.57+dfsg-3`	vulnerable
Debian	keepass2	12	`2.57+dfsg-4`	vulnerable
Debian	keepass2	12	`2.60+dfsg-1`	vulnerable
Debian	keepass2	13	`2.57+dfsg-3`	vulnerable
Debian	keepass2	13	`2.57+dfsg-4`	vulnerable
Debian	keepass2	13	`2.60+dfsg-1`	vulnerable
Debian	keepass2	14	`2.57+dfsg-3`	vulnerable
Debian	keepass2	14	`2.57+dfsg-4`	vulnerable
Debian	keepass2	14	`2.60+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[keepass2]Affected
Details (4)
- 2.47+dfsg-2 · all · bookworm
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.47+dfsg-2 · all · bookworm
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.57+dfsg-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.57+dfsg-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
[keepass2-doc]Affected
Source package: [keepass2]
Details (4)
- 2.47+dfsg-2 · all · bookworm
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.47+dfsg-2 · all · bookworm
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.57+dfsg-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12
- 2.57+dfsg-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · keepass2 · debian · bookworm; nvd · keepass2 · debian · 12

[Debian 13 (Trixie)]

[keepass2]Affected
Details (2)
- 2.57+dfsg-3 · all · trixie
  Affected
  nvd · keepass2 · debian · 13
- 2.57+dfsg-3 · all · trixie
  Affected
  nvd · keepass2 · debian · 13
[keepass2-doc]Affected
Source package: [keepass2]
Details (2)
- 2.57+dfsg-3 · all · trixie
  Affected
  nvd · keepass2 · debian · 13
- 2.57+dfsg-3 · all · trixie
  Affected
  nvd · keepass2 · debian · 13

Observed: Oct 23, 2026, 9:28:52 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]