# Exploitable and unpatched KeePass vulnerability: everything you need to know

KeePass's SecureTextBoxEx leaves per-character traces in memory, letting an attacker with local access recover the master password (minus first char) even when the database is locked.

- Payout: Research
- Severity: high
- Program: KeePass
- Write-up by: Wiz Research
- Disclosed: 2023-05-23
- CVE: CVE-2023-32784
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/cve-2023-32784-keepass-vulnerability-exploit-released
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2023-32784-keepass-vulnerability-exploit-released
- Tags: area:os domain:desktop impact:ato impact:data-leak kind:research platform:threat-intel sev:high vuln:info-disclosure vuln:secrets-leak

**Target:** KeePass desktop password manager process memory
**Root cause:** The custom password entry control SecureTextBoxEx stores traces of each character typed by the user in memory instead of a single managed buffer, so residual per-character strings persist in the process.
**Steps:**
1. Obtain local access to a machine running vulnerable KeePass (2.0 through pre-2.54).
2. Dump the KeePass process memory (or crash dumps/hibernation/pagefile) even if the workspace is locked or the program is closed.
3. Scan the dump for the residual per-character traces left by SecureTextBoxEx.
4. Reconstruct the master password from the traces; the first character is not recoverable.
5. Brute-force the single unknown first character to obtain the full master password.
**Exploitation:** An attacker who already has access to the vulnerable machine dumps process memory or leftover crash/hibernation/swap files and recovers the master password in plaintext except the first character, then enumerates the first character to unlock the vault and access all stored credentials.
**Insight:** Custom secure-input controls that handle characters individually can leave per-character remnants in memory; dump process memory and crash/hibernation/swap files rather than only the locked UI to recover secrets.