KeePassXC 2.8.0 Fixes KDB Import and Browser Communication Vulnerabilities

KeePassXC 2.8.0 fixes several security vulnerabilities affecting versions 2.7.x and earlier, including CVE-2026-69150, a use-after-free flaw involving legacy KDB file imports. The release also addresses additional memory-safety issues in the KDB importer, entry-reference injection, and out-of-bounds writes in browser-extension communications. Developers classify the vulnerabilities as low to medium severity and state that the password manager’s core functionality and cryptography are unaffected. The reports do not establish active exploitation.

Users and administrators should update to KeePassXC 2.8.0, as recommended by the developers, particularly where legacy database imports or browser integration are used. The release also migrates the application from Qt5 to Qt6 and adds Wayland Auto-Type support, database synchronization through external programs, additional authentication options, SSH key generation, and expanded ARM64 builds. Character-encoding corruption in the OpenNET reports limits verification of some technical details, including precise exploitation requirements.