# CVE-2023-32784

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation.

- Page: https://www.vulneraibility.com/cve/CVE-2023-32784
- CVSS: 7.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 4.40% (percentile 91.4)
- Unvetted proof-of-concept code on GitHub: 14 GitHub proofs of concept (first 2023-05-01)
- CISA SSVC: exploitation poc, automatable yes, technical impact partial (assessed 2025-01-23)
- Weakness: CWE-319
- Published: 2023-05-15

## Affected

- keepass:keepass

## References

- [other] https://github.com/vdohney/keepass-password-dumper
- [other] https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/
- [other] https://github.com/keepassxreboot/keepassxc/discussions/9433

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.