CVE-2026-69150

What it is

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. High risk of service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-10-13 16:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-16 20:02 UTC Last updatedMost recent change to the record

Details

Published

2026-10-13 16:17 UTC

Last modified

2026-10-16 20:02 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-416 · Use after free

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 4.3

Attack vector

Local

Complexity

High

Attack requirements

Present

Privileges needed

Low

User interaction

Active

Confidentiality

None

Integrity

Low

Availability

High