KeePassXC 2.8.0 fixes memory bugs in import and browser integration
Original title: KeePassXC 2.8.0 Released to Fix Multiple Security Vulnerabilities Affecting Password Manager
Eight security fixes shipped on October 21; only CVE-2026-69150 has an assigned identifier.
KeePassXC 2.8.0, published October 21, fixes memory-safety bugs in legacy KDB imports, browser integration, SSH key handling, and sensitive-data protections. CVE-2026-69150 is a use-after-free when importing specially crafted KDB files. Four further issues still await CVE assignment, and the notes give no severity scores or sign of active exploitation. Users of legacy imports, browser integration, or Pageant are told to upgrade; no interim workaround is described.
Unconfirmed: Four issues still lack CVE identifiers, and the notes do not state severity or exploitation prerequisites.
- An integer overflow and out-of-bounds read also affect the legacy KDB importer.
- Browser fixes cover entry-reference injection and native-messaging out-of-bounds writes.
- Windows shared-memory names for Pageant SSH key transfer are now randomized.
- The release migrates to Qt 6 and adds several non-security features.
Impact: Memory corruption when importing crafted KDB files or handling browser messages.
| Product | Affected | Fixed in |
|---|---|---|
| KeePassXC | — | 2.8.0 |
- 1.Upgrade to KeePassXC 2.8.0, especially if using legacy KDB import, browser integration, or Pageant.
- CVEs
- CVE-2026-69150
- Vendors
- KeePassXC
- Organizations
- NATO Cyber Security Center
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-69150 | Heap use-after-free in KeePassXC KDB import before 2.8.0-beta1 | 4.3 | — |
From the original article
3 min read at gbhackers.com
KeePassXC has released version 2. 8. 0 to address multiple security vulnerabilities related to database imports, browser integration, SSH key handling, and the protection of sensitive information.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.