Description
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keepass2 | No fix yet | — |
| Debian 13 | keepass2 | No fix yet | — |
| Debian 12 | keepass2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | keepass2 | No fix yet | — |
| Ubuntu 26.04 LTS | keepass2 | No fix yet | — |
| Ubuntu 25.10 | keepass2 | No fix yet | — |
| Ubuntu 24.04 LTS | keepass2 | No fix yet | — |
| Ubuntu 22.04 LTS | keepass2 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | keepass2 | No fix yet | — |
| Ubuntu 18.04 LTS | keepass2 | No fix yet | — |
| Ubuntu 16.04 LTS | keepass2 | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | keepass | 2.54-bp155.2.3.1 | openSUSE-SU-2023:0163-1 |
| SUSE Package Hub 15 SP4 | keepass | 2.54-bp154.2.3.1 | openSUSE-SU-2023:0157-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | keepass | 2.54-1.1 | openSUSE-SU-2024:12982-1 |
| openSUSE Leap 15.5 | keepass | 2.54-bp155.2.3.1 | openSUSE-SU-2023:0163-1 |
| openSUSE Leap 15.4 | keepass | 2.54-bp154.2.3.1 | openSUSE-SU-2023:0157-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 14 repositories · most starred shown
-
vdohney/keepass-password-dumper ★ 650 · May 1, 2023
Original PoC for CVE-2023-32784
-
z-jxy/keepass_dump ★ 28 · May 22, 2023
KeePass 2.X dumper (CVE-2023-32784)
-
und3sc0n0c1d0/BruteForce-to-KeePass ★ 6 · May 20, 2023
This script complements the results obtained through the keepass-password-dumper tool when exploiting the CVE-2023-32784 vulnerability affecting KeePass.
-
mister-turtle/cve-2023-32784 ★ 4 · Feb 1, 2024
-
CTM1/CVE-2023-32784-keepass-linux ★ 2 · May 17, 2023
KeePass Master Password Extraction PoC for Linux
-
G4sp4rCS/CVE-2023-32784-password-combinator-fixer ★ 0 · Mar 31, 2025
After using the KeePass password dumper maybe some character parsed as ● is incorrect and you want to know the real character
-
dev0558/CVE-2023-32784-EXPLOIT-REPORT ★ 0 · Dec 4, 2024
-
Cmadhushanka/CVE-2023-32784-Exploitation ★ 0 · Jul 10, 2024
year 2 semester 1 Systems and Network Programming Assignment
-
dawnl3ss/CVE-2023-32784 ★ 0 · Aug 30, 2023
Retrieve the master password of a keepass database <= 2.53.1
-
hau-zy/KeePass-dump-py ★ 0 · Jun 4, 2023
Re-write of original KeePass 2.X Master Password Dumper (CVE-2023-32784) POC in python.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- openSUSE-SU-2024:12982-1 keepass-2.54-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2023:0157-1 Security update for keepass SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2023:0163-1 Security update for keepass SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-1207 KeePass: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · May 14, 2023