Hashcat contains a heap-based buffer overflow vulnerability in the outfile_write() function in src/outfile.c. This occurs when assembling output into a fixed-size buffer (~16 MB) without validating the total length, allowing an out-of-bounds write if a crafted hash file with an oversized username is used. The vulnerability can cause memory corruption and process crashes when running hashcat with --username --show against such crafted input.