VulnSocial

CVE-2026-69150

LOWCVSS 4.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-416

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-18: 110-18
Full discourse1 post
  • Sealzi@SealziOfficial

    Two disclosed CVEs this year, different scopes: Bitwarden had a critical account-takeover bug (CVE-2026-60104 — vault keys + tokens leaked via admin auth-request, public PoC) and KeePassXC's legacy KDB importer had a crash bug (CVE-2026-69150)

    0001082
    5 followersView on X

Explore more

Back to dashboard