CVE-2026-68768 is a heap-based buffer overflow vulnerability in hashcat's outfile_write() function. The vulnerability arises because the function appends multiple data elements into a fixed-size buffer without checking if the combined length exceeds the buffer size (HCBUFSIZ_LARGE, approximately 16 MB). Specifically, when run with the --username --show flags on a maliciously crafted hash file containing an oversized username, the buffer overflow occurs, leading to potential memory corruption and process crash. The vulnerability is classified under CWE-120 (buffer copy without checking size of input).

The vulnerability can cause heap memory corruption and crash the hashcat process when exploited. There is no indication of confidentiality or integrity loss beyond process disruption. The CVSS v3.1 score is 6.1 (medium severity), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and impact limited to integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running hashcat with the --username --show options on untrusted or crafted hash files that may contain oversized usernames.