CVE-2026-69150

Executive Summary

CVE-2026-69150 is a heap use-after-free (CWE-416) in KeePassXC's KeePass1 / KDB legacy import path, affecting all releases prior to 2.8.0-beta1. The flaw is triggered when a user imports a crafted, unlockable .kdb file — a low-privilege or external attacker who can deliver such a file can cause a controlled heap write through a stale Entry pointer, resulting in a reliable process crash and potential memory-corruption primitives. Given that the issue requires opening a malicious file and the patch is currently tracked as unverified, the primary exposure is to credential-management workstations when importing untrusted legacy KeePass databases.

Technical Analysis

KeePassXC maintains a KeePass1 / KDB legacy import code path for backward compatibility with the older .kdb database format. According to the NVD description, this importer retains raw Entry pointers in a structure named m_entryUuids after it deletes the corresponding metastream entries. Because the Entry objects are freed during metastream cleanup while their pointers remain indexed in m_entryUuids, the map effectively becomes a collection of dangling references.

The trigger condition is a crafted, unlockable .kdb file arranged in a specific sequence:

1. An earlier metastream entry is parsed, causing the corresponding Entry to be created and then deleted during metastream processing.
2. A subsequent KPX_CUSTOM_ICONS_4 metastream follows and references the UUID of that earlier, now-freed entry.
3. During the KPX_CUSTOM_ICONS_4 handling, parseCustomIcons4() performs a lookup that resolves the referenced UUID through m_entryUuids and subsequently invokes Entry::setIcon on the stale pointer.

Because Entry::setIcon writes into an object that has already been freed, the operation becomes a heap use-after-free with a constrained, attacker-influenced write — the payload values derive from the icon data supplied in the crafted file. The NVD description characterizes the write as "controlled" and the crash as "reliable," indicating a deterministic failure state rather than a probabilistic one. Exploitation beyond denial of service would require the attacker to arrange the heap such that the freed Entry region is reused by a subsequently allocated object whose layout is compatible with the write performed by setIcon; the description does not provide the object size or the exact field offset written, so the feasibility of reliable code execution versus crash-only impact cannot be confirmed from the available data.

Attack surface: the KDB importer is only reachable through explicit user action (File → Import / opening a .kdb database), which constrains remote exploitation. No network-facing service in KeePassXC is involved. The vulnerable code path concerns in-memory object lifetime management — specifically, the failure to invalidate m_entryUuids entries when their referenced Entry objects are destroyed.

The fix in 2.8.0-beta1 presumably addresses the pointer lifetime mismatch (e.g., removing or invalidating stale entries in m_entryUuids when the backing Entry is freed), though the specific code change is not enumerated in the provided data. No public proof-of-concept, exploit code, or Nuclei template exists for this CVE.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the mechanics described in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a victim who uses KeePassXC at a version below 2.8.0-beta1 and who may handle legacy .kdb files — for example, administrators migrating from KeePass 1.x, help-desk staff receiving exported databases, or users in environments that still exchange .kdb artifacts. Delivery vectors for a file-based attack include email attachments, shared network folders, chat/file-transfer channels, and web downloads.

2. Triggering the flaw class. The attacker crafts a .kdb file that is structurally valid enough to be unlockable and to be accepted by the importer. The file must contain (a) an earlier metastream entry whose Entry is registered and then deleted, and (b) a later KPX_CUSTOM_ICONS_4 metastream that references the UUID of that deleted entry. When the victim imports the file, the KeePass1 / KDB importer leaves stale pointers in m_entryUuids, and the KPX_CUSTOM_ICONS_4 processing path resolves the dangling UUID.

3. Payload / execution method (vulnerability-class level). The attacker-supplied icon data in the KPX_CUSTOM_ICONS_4 metastream reaches Entry::setIcon through the stale pointer, producing a heap use-after-free write into freed memory. At the vulnerability-class level, this is a lifetime-management error: a persistent index (m_entryUuids) outlives the objects it references. The attacker's control is over when the write occurs and the icon-derived data written; the precise heap grooming required to convert the write into code execution is not documented in the available data.

4. Post-exploitation impact. The immediately demonstrable outcome is a reliable process crash (denial of service) of KeePassXC during import. Where heap layout can be influenced, a controlled write into a reused heap region could in principle corrupt adjacent objects or function pointers, enabling further exploitation; however, the NVD description does not establish code-execution reliability, so this should be treated as a theoretical escalation path rather than a confirmed outcome.

Impact Assessment

No CVSS score or vector was published for CVE-2026-69150 in the provided NVD data, and the CVE has not been scored by FIRST.org (no EPSS value available). Impact must therefore be assessed qualitatively:

• Availability: High-confidence local denial of service. The description explicitly states the crash is "reliable," meaning any successful import of the crafted file terminates the application.
• Confidentiality / Integrity: Potentially impacted if the controlled heap write can be leveraged for memory corruption beyond a crash. The description notes a "controlled write" but does not establish arbitrary read/write or code execution. Given KeePassXC's role as a credential manager, even a theoretical corruption primitive on a vault-handling process carries elevated sensitivity — an attacker positioned on the same host could attempt to interfere with in-memory secret handling.
• Attack vector / prerequisites: Local, user-assisted. Exploitation requires the victim to open/import an attacker-supplied .kdb file. This is not remotely reachable and not wormable.
• Blast radius: Scoped to individual workstations that import the malicious legacy database. In managed fleets, the risk concentrates in environments that still accept .kdb files from external or untrusted sources.
• Exploit maturity: No public PoC, no exploit code, no Nuclei template, and not listed in CISA KEV. Exploitation in the wild is not evidenced.

Detection Guidance

Sigma Rule

title: KeePassXC KDB Import Heap Use-After-Free Attempt (CVE-2026-69150)
id: 5b1f0c4e-9d2a-4f3b-8c7e-1a2b3c4d5e6f
status: experimental
description: Detects KeePassXC process crashes indicative of the KeePass1/KDB legacy import use-after-free when handling a crafted .kdb file referencing KPX_CUSTOM_ICONS_4 entries.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69150
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1204
  - attack.t1499.004
logsource:
  category: application
  product: windows
detection:
  selection_crash:
    Provider_Name: 'Application Error'
    Message|contains|all:
      - 'keepassxc'
  selection_fault:
    Provider_Name: 'Windows Error Reporting'
    Message|contains|all:
      - 'keepassxc'
      - 'APPCRASH'
  condition: selection_crash or selection_fault
falsepositives:
  - Legitimate KeePassXC crashes from unrelated bugs
  - Beta/test builds of KeePassXC
level: medium

YARA Rule

rule CVE_2026_69150_KDB_CustomIcons_Metastream
{
    meta:
        description = "Detects .kdb files containing a KPX_CUSTOM_ICONS_4 metastream which may trigger CVE-2026-69150 during KeePass1/KDB import"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69150"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $magic_kdb = { 03 D9 A2 9A 67 FB 4B B5 }   // KeePass 1.x KDB signature
        $kpx_icons = "KPX_CUSTOM_ICONS_4" ascii wide

    condition:
        $magic_kdb at 0 and $kpx_icons
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-69150 KeePassXC KDB File Transfer With KPX_CUSTOM_ICONS_4 Metastream"; flow:established,to_server; content:"KPX_CUSTOM_ICONS_4"; nocase; content:"|03 D9 A2 9A 67 FB 4B B5|"; within:2048; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,2026-69150; sid:2026691500; rev:1;)

Elastic Detection

process where event.type == "start" and
process.name : ("keepassxc.exe", "keepassxc", "KeePassXC") and
process.args : ("*.kdb", "--import") and
process.exit_code != 0

Splunk SPL Query

index=endpoint (source=WinEventLog:Application OR source=syslog)
(Provider_Name="Application Error" OR Provider_Name="Windows Error Reporting" OR Message="*segfault*" OR Message="*core dump*")
(Message="*keepassxc*" OR Message="*KeePassXC*")
| rex field=Message "(?<faulting_module>[A-Za-z0-9_\.\-]+\.(dll|so))"
| stats count min(_time) as first_seen max(_time) as last_seen values(faulting_module) as modules by host, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="keepassxc,cve-2026-69150,">
  <rule id="100150" level="7">
    <decoded_as>json</decoded_as>
    <field name="event.type">crash</field>
    <field name="process.name">keepassxc</field>
    <description>CVE-2026-69150: KeePassXC process crash detected (possible KDB import use-after-free)</description>
    <mitre>
      <id>T1204</id>
      <id>T1499.004</id>
    </mitre>
    <group>vulnerability,cve_2026_69150,</group>
  </rule>
  <rule id="100151" level="10">
    <if_sid>100150</if_sid>
    <field name="process.args">\.kdb$</field>
    <description>CVE-2026-69150: KeePassXC crashed while importing a .kdb file - likely exploitation attempt</description>
    <group>vulnerability,exploit_attempt,cve_2026_69150,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 2.8.0-beta1, but no vendor advisory, patch sources, or stable-channel release were supplied in the provided data, so no vendor fix or workaround can be confirmed from tracked sources.

1) Immediate mitigations

• Do not open or import .kdb (KeePass 1.x / legacy) files from untrusted or unverified sources. Treat KDB files as untrusted input, equivalent to any other file format associated with memory-safety bugs.
• Disable or restrict KDB import workflows: educate users, and where possible enforce policy that legacy .kdb imports require prior validation in an isolated environment.
• If a KDB import is mandatory, perform it inside a disposable VM or sandboxed container with no access to production credential stores or sensitive network segments.
• Restrict file-delivery vectors (email attachments, shared drives) that commonly carry malicious database files; scan incoming .kdb files with the YARA rule above.
• Monitor for KeePassXC crash reports during or immediately after file imports — repeated crashes on the same file are a strong indicator of a triggered use-after-free.

2) Patch / upgrade steps

• Upgrade to KeePassXC 2.8.0-beta1 or later once availability and integrity of the release are independently verified against the official KeePassXC distribution channels.
• Because no stable-channel fix is confirmed in the provided data, treat the 2.8.0-beta1 designation as a development milestone and coordinate with the vendor or distribution maintainers before deploying to production.
• Maintain an inventory of KeePassXC versions across endpoints and flag any installation below 2.8.0-beta1.

3) Long-term hardening

• Establish a software bill of materials (SBOM) and version-tracking process for endpoint credential-management tools.
• Apply exploit-mitigation hardening (ASLR, CFG, stack/heap protections) at the OS and compiler level to raise the difficulty of converting memory-corruption bugs into code execution.
• Adopt a fuzzing and memory-sanitizer (ASan/UBSan) based testing pipeline for file-format parsers, including the KeePass1/KDB legacy importer, to catch lifetime-management errors before release.
• Enforce least-privilege execution for password managers and consider endpoint detection coverage for use-after-free crash patterns in security-critical processes.

References

• NVD — CVE-2026-69150: https://nvd.nist.gov/vuln/detail/CVE-2026-69150
• KeePassXC project site and release notes: https://keepassxc.org/
• MITRE ATT&CK — T1204 User Execution: https://attack.mitre.org/techniques/T1204/
• MITRE ATT&CK — T1499.004 Application or System Exploitation (DoS): https://attack.mitre.org/techniques/T1499/004/
• CWE-416 Use After Free: https://cwe.mitre.org/data/definitions/416.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, public exploit code, PoC repositories, or exploit-in-the-wild evidence were identified for CVE-2026-69150 in the available data.