KeePassXC · Disclosed

KeePassXC 2.8.0 fixes use-after-free in legacy KDB import

Oct 25, 2026 · 1 min read

KeePassXC released version 2.8.0 with security fixes, according to DarkWebInformer. The update fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file, plus browser, memory safety, and Windows issues still awaiting CVE assignments. Sources report no exploitation; update to 2.8.0.

By HIFY Radar newsroom Updated 10/26/2026 02:33 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

KeePassXC released version 2.8.0 on 2026-10-26 with several security fixes, according to DarkWebInformer. The main one fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file. Other browser, memory safety, and Windows flaws are still awaiting CVE assignments.

Why it matters

KeePassXC stores all of a company's passwords in one place. A malicious vault file sent to an employee, once imported, could crash or compromise that person's password manager. Any user who imports legacy KDB files from untrusted sources is exposed.

What to do

Update KeePassXC to version 2.8.0 on all workstations. Until then, instruct users not to import legacy KDB files received from third parties.

For the technical team

CVE: CVE-2026-69150
Affected: KeePassXC (gerenciador de senhas) · KeePassXC versions prior to 2.8.0; users importing crafted legacy KDB files.
Exploitation: No exploitation reported in the sources. Fix disclosed on 2026-10-26 by DarkWebInformer; additional flaws still awaiting CVE assignments.
Fix: Update to KeePassXC 2.8.0. Partial mitigation: do not import legacy KDB files from untrusted sources.
Vector: Legacy KDB importer: use-after-free triggered when importing a crafted legacy KDB file; the same importer also has an integer overflow and an out-of-bounds read. Requires the user to import the file. Other fixed flaws: browser entry reference injection, out-of-bounds writes in native messaging, weak Pageant shared-memory mapping names on Windows, and insufficient clearing of decrypted database fragments from memory.
More details: Release 2.8.0 also migrates to Qt 6 and adds remote database synchronization, configurable shortcuts, SSH key generation, Wayland Auto-Type, Linux Quick Unlock, and native Windows Arm64 builds. Single source: DarkWebInformer post on X.