CVE-2026-4158

CVE-2026-4158 is a local privilege escalation vulnerability affecting KeePassXC that stems from improper OpenSSL configuration management. The flaw allows attackers to load configuration files from unsecured locations, enabling arbitrary code execution within the KeePassXC process context when exploited by a low-privileged user. The vulnerability carries a CVSS score of 7.3 (HIGH), requiring local access and low privileges to exploit, though user interaction is necessary for successful attack. The attack complexity is low, and successful exploitation grants attackers high-level impact across confidentiality, integrity, and availability. Exploitation of this vulnerability remains minimal, with no evidence of active real-world attacks or public exploit availability. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and shows an extremely low EPSS score of 0.00014, indicating limited practical exploitation risk at this time.