Dear Maintainer and Security Team,

I am reporting the public upstream advisory GHSA-4642-49vv-4p43 for
assessment in Debian:
https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43

Upstream reports a heap use-after-free when importing a crafted
KeePass 1 (.kdb) database. Deleted entries remain referenced in the
importer's UUID map and can later be dereferenced. The advisory
describes a confirmed crash and an attacker-controlled write; I have
not tested exploitability on Debian.

The advisory identifies the tested version as 2.7.12 and the patched
version as 2.8.0. The release announcement says that the 2.7.x series
and earlier versions are affected. Please verify applicability to
Debian's 2.7.10 package. Upstream states that the legacy reader is not
conditional on an optional build flag.

The release notes identify this issue as CVE-2026-69150 and associate
its fix with upstream PR #13500.

The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026:
https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/

I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have
not independently reproduced this issue or verified whether
Debian-specific patches address it. On 10 October 2026, I could not
find a corresponding entry on the package's Security Tracker page or a
matching report in the current source-package bug list.

Could you assess whether Debian is affected and consider backporting
the applicable fix to trixie? Please adjust the severity as
appropriate.

Thank you,
Jonatan Nyberg