This vulnerability involves a heap-based buffer overflow in the hex_to_binary function within the PKZIP hash parser of hashcat v7.1.2. Specifically, when the data_type_enum is less than or equal to 1, the function decodes attacker-controlled hex data from a user-supplied hash string into a fixed-size buffer without validating the input length. This affects multiple hashcat modules related to PKZIP hashes (17200, 17210, 17220, 17225, and 17230), potentially allowing an attacker to cause a denial of service or execute arbitrary code.

An attacker who supplies a crafted PKZIP hash string can trigger a heap-based buffer overflow in hashcat v7.1.2, which may result in denial of service or potentially arbitrary code execution. No known exploits in the wild have been reported. The vulnerability affects local usage of hashcat and does not involve cloud services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and avoid processing untrusted PKZIP hash inputs until a fix is available.