Dear Maintainer and Security Team,

I am reporting the public upstream advisory GHSA-3448-gh8j-3227 for
assessment in Debian:
https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-3448-gh8j-3227

Upstream reports an out-of-bounds write when encrypting oversized
browser-integration responses. A client with a valid database
association can trigger the problem when an unlocked database produces
a sufficiently large authorized response.

The advisory lists versions 2.3.0 through 2.7.12 as affected and 2.8.0
as patched. The upstream reproducer demonstrated a process crash on
Windows; it does not establish code execution or credential
disclosure, and I have not tested the impact on Debian. The affected
code is in the cross-platform desktop application's browser
integration.

The release notes associate this fix with upstream PR #13679. The
decrypt-path changes are described in the advisory as defense in depth
rather than a separately confirmed reachable vulnerability.

The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026:
https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/

I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have
not independently reproduced this issue or verified whether
Debian-specific patches address it. On 10 October 2026, I could not
find a corresponding entry on the package's Security Tracker page or a
matching report in the current source-package bug list.

Could you assess whether Debian is affected and consider backporting
the applicable fix to trixie? Please adjust the severity as
appropriate.

Thank you,
Jonatan Nyberg