This vulnerability exists in the module_hash_decode function of multiple Kerberos-related modules within hashcat v7.1.2. The issue stems from calculating account_info_len based on untrusted delimiter positions without enforcing an upper bound, leading to a heap-based buffer overflow when memcpy copies data into a fixed-size account_info buffer. This can result in denial of service or arbitrary code execution if exploited via a crafted Kerberos hash file.

Successful exploitation can cause application crashes (denial of service) or potentially allow execution of arbitrary code within the context of the vulnerable application. This could lead to compromise of the system running hashcat if an attacker can supply malicious Kerberos hash files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or malicious Kerberos hash files with hashcat v7.1.2 to mitigate risk.