Dear Maintainer and Security Team,

I am reporting the public upstream advisory GHSA-rq29-wgrv-xgh4 for
assessment in Debian:
https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-rq29-wgrv-xgh4

Upstream reports an integer overflow in the legacy KeePass 1 (.kdb)
importer. A crafted record count can overflow a 32-bit multiplication
in parseGroupTreeState(), bypassing the buffer-length check and
causing out-of-bounds reads.

The advisory lists versions before 2.8.0 as affected and 2.8.0 as
patched. Upstream assesses the impact as denial of service requiring
import of a crafted file and rates the issue Low. The patch performs
the multiplication using a 64-bit integer.

The release notes associate this fix with upstream PR #13682.

The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026:
https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/

I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have
not independently reproduced this issue or verified whether
Debian-specific patches address it. On 10 October 2026, I could not
find a corresponding entry on the package's Security Tracker page or a
matching report in the current source-package bug list.

Could you assess whether Debian is affected and consider backporting
the applicable fix to trixie? Please adjust the severity as
appropriate.

Thank you,
Jonatan Nyberg