hashcat's fgetl() function in src/filehandling.c improperly handles input lines that are exactly the size of the buffer by writing a null terminator one byte past the caller's buffer boundary. This results in an out-of-bounds heap write (CWE-193). An attacker can exploit this by supplying a hash file, potfile, or wordlist containing a line exactly HCBUFSIZ_LARGE bytes long. The vulnerability has been cataloged as CVE-2026-68767 with a CVSS 3.1 score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H), indicating local attack vector with low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

The vulnerability allows an out-of-bounds heap write which can lead to integrity loss and denial of service (availability impact). There is no confidentiality impact reported. Exploitation requires local access and user interaction. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or patch, avoid processing untrusted hash files, potfiles, or wordlists containing lines exactly the size of HCBUFSIZ_LARGE bytes. Monitor vendor channels for updates and apply patches once available.