This vulnerability in hashcat v7.1.2 involves a stack-based buffer overflow in the mangle_to_hex_lower() and mangle_to_hex_upper() functions located in src/rp_cpu.c. The root cause is a bounds check that fails to account for the 2x expansion when converting password bytes to hexadecimal representation. Exploitation requires crafted input via rule files or specific command-line options (-j or -k) with long password candidates (128+ characters). The overflow can lead to denial of service or possibly arbitrary code execution. No CVSS score or vendor advisory is available, and no patch status is confirmed.

Successful exploitation can cause a denial of service by crashing the application or potentially allow execution of arbitrary code, which could lead to compromise of the host running hashcat. The impact depends on attacker ability to supply crafted rule files or command-line inputs with long password candidates. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted rule files or the -j and -k options with password candidates of 128 or more characters to reduce risk of triggering the vulnerability.