Master-password disclosure via secure textbox string remnants

Information disclosure in KeePass 2.x before 2.54 allows local users to recover most of a typed master password from a memory dump. For each typed character, SecureTextBoxEx creates a managed .NET string containing bullet placeholders and the new character, leaving ordered remnants that survive locking and process exit. The attack requires access to process or system memory after keyboard entry; it cannot recover the first character and does not operate remotely by itself.