KeePass Password Safe versions prior to 2.44 contain a code injection vulnerability in the help system that can be leveraged to cause application instability and denial of service.

The application fails to properly sanitize input within the help system's HTML handling component. An unauthenticated local attacker can trigger this vulnerability by dragging and dropping a specially crafted HTML file into the help interface, which may lead to application crashes or unauthorized code execution depending on the local environment.

Successful exploitation of this vulnerability can lead to a denial of service, rendering the password management software unusable. In a professional environment, this causes operational disruption for users who rely on the software for credential management. While the CVSS score of 7.5 indicates a high severity, the requirement for local interaction limits the scope of the threat compared to remote network attacks.

Immediate Action: Update the KeePass Password Safe installation to version 2.44 or later to patch the vulnerable HTML handling logic.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous behavior associated with the KeePass executable, particularly following user interface interactions.

Compensating Controls: Restrict user permissions to prevent the execution of untrusted or externally sourced HTML files on systems where KeePass is deployed.

Public Exploit Available: Yes — a proof-of-concept exploit is documented in the Exploit Database (EDB-ID: 47952).

The vulnerability presents a significant risk to the availability of credential management systems. Organizations must prioritize upgrading to version 2.44 or newer across all endpoints to ensure the help system's HTML parsing component is secure. Failure to patch leaves systems susceptible to application-level denial of service attacks.