How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?  

Is this a serious threat, or would a brute force attack require massive computing time?  

Assume a password more than 10 characters long with randomly distributed characters of the set including all letters, numbers and most non-alphanumeric keyboard symbols.

KeePass uses a custom password derivation process which includes multiple iterations of symmetric encryption with a random key (which then serves as salt), as explained there. The default number of iterations is 6000, so that's 12000 AES invocations for processing one password (encryption is done on a 256-bit value, AES uses 128-bit blocks, so there must be two AES invocations at least for each round). With a quad-core recent PC (those with the spiffy AES instructions), you should be able to test about 32000 potential passwords per second.

With ten random characters chosen uniformly among the hundred-of-so of characters which can be typed on a keyboard, there are 1020 potential passwords, and brute force will, on average, try half of them. You're in for 1020*0.5/32000 seconds, also known as 50 million years. But with two PC that's only 25 million years.

This assumes that the password derivation process is not flawed in some way. In "custom password derivation process", the "custom" is a scary word. Also, the number of iterations is configurable (6000 is only the default value).
