CVE-2024-33901

Deeper analysis

CVE-2024-33901 affects KeePassXC 2.7.7 and stems from memory-management behavior that leaves portions of decrypted .kdbx database contents, including some stored passwords, readable in process memory. The flaw is tracked under CWE-316 and carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, and low-privileged access resulting in high confidentiality impact.

An attacker who already possesses the privileges of the victim user can obtain a memory dump of the KeePassXC process and extract the exposed password material. Because the issue is inherent to the current design constraints around keeping decrypted data in RAM for usability, the vendor disputes that the behavior constitutes a vulnerability that can be eliminated without unacceptable trade-offs.

Public references, including the KeePassXC issue tracker and the project’s prior memory-security write-up, indicate no patch is planned and reiterate that realistic alternatives still require sensitive data to reside in process memory during active sessions. The associated EPSS score has remained flat at 0.2377 with no observed rise after disclosure.