Search
Find a vulnerability
Search criteria
2 vulnerabilities by gnupg
GCVE-1-2026-0008
Vulnerability from gna-1 – Published: 2026-01-28 13:48 – Updated: 2026-01-28 13:48
VLAI
Title
gpg-agent stack buffer overflow in pkdecrypt using KEM
Summary
A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped
session key (AES Key Wrap ciphertext) can cause a stack buffer overflow in
gpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an
unbounded session key length derived from attacker-controlled ciphertext
and used as the AES Key Wrap output length when decrypting into a
fixed-size stack buffer. libgcrypt’s AES-KW unwrap copies
attacker-controlled bytes into the caller-provided output buffer before
performing integrity checks, so the stack overflow occurs even if later CMS
or key-wrap integrity validation fails.
Severity
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://dev.gnupg.org/T8044 | issue-tracking |
Credits
Relationships
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "gpg-agent",
"vendor": "gnupg",
"versions": [
{
"lessThan": "2.5.17",
"status": "affected",
"version": "2.5.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "OpenAI Security Research"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Werner Koch"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped\u003cbr\u003e\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in\u003cbr\u003e\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an\u003cbr\u003e\nunbounded session key length derived from attacker-controlled ciphertext\u003cbr\u003e\nand used as the AES Key Wrap output length when decrypting into a\u003cbr\u003e\nfixed-size stack buffer. libgcrypt\u2019s AES-KW unwrap copies\u003cbr\u003e\nattacker-controlled bytes into the caller-provided output buffer before\u003cbr\u003e\nperforming integrity checks, so the stack overflow occurs even if later CMS\u003cbr\u003e\nor key-wrap integrity validation fails.\u003cbr\u003e"
}
],
"value": "A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped\n\nsession key (AES Key Wrap ciphertext) can cause a stack buffer overflow in\n\ngpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an\n\nunbounded session key length derived from attacker-controlled ciphertext\n\nand used as the AES Key Wrap output length when decrypting into a\n\nfixed-size stack buffer. libgcrypt\u2019s AES-KW unwrap copies\n\nattacker-controlled bytes into the caller-provided output buffer before\n\nperforming integrity checks, so the stack overflow occurs even if later CMS\n\nor key-wrap integrity validation fails."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://dev.gnupg.org/T8044"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "gpg-agent stack buffer overflow in pkdecrypt using KEM",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-0008"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"datePublished": "2026-01-28T13:48:12.350509Z",
"dateUpdated": "2026-01-28T13:48:12.350509Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-0008",
"vulnerabilitylookup_history": [
[
"alexandre.dulaunoy@circl.lu",
"2026-01-28T13:48:12.350509Z"
]
]
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-0001
Vulnerability from gna-1 – Published: 2026-01-02 10:20 – Updated: 2026-01-02 13:31
VLAI
Title
Bundle reference to gpg.fail
Summary
Reference to the gpg.fail
1. Multiple Plaintext Attack on Detached PGP Signatures in GnuPG - https://gpg.fail/detached
2. GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field - https://gpg.fail/filename
3. Cleartext Signature Plaintext Truncated for Hash Calculation - https://gpg.fail/formfeed
4. Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks - https://gpg.fail/malleability
5. Memory Corruption in ASCII-Armor Parsing - https://gpg.fail/memcpy
6. Trusted comment injection (minisign) - https://gpg.fail/minisign
7. Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG - https://gpg.fail/notdash
8. OpenPGP Cleartext Signature Framework Susceptible to Format Confusion - https://gpg.fail/notsoclear
9. GnuPG Output Fails To Distinguish Signature Verification Success From Message Content https://gpg.fail/noverify
10. Cleartext Signature Forgery in GnuPG - https://gpg.fail/nullbyte
11. Radix64 Line-Truncation Enabling Polyglot Attacks - https://gpg.fail/polyglot
12. GnuPG may downgrade digest algorithm to SHA1 during key signature checking - https://gpg.fail/sha1
13. GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys - https://gpg.fail/trust
14. Trusted comment Injection (minisign) - https://gpg.fail/trustcomment
Severity
No CVSS data available.
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://gpg.fail/ |
Relationships
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "gnupg",
"vendor": "gnupg",
"versions": [
{
"status": "affected"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eReference to the\u0026nbsp;gpg.fail\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e1.\u0026nbsp; Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/detached\"\u003ehttps://gpg.fail/detached\u003c/a\u003e\u003cbr\u003e2.\u0026nbsp; GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/filename\"\u003ehttps://gpg.fail/filename\u003c/a\u003e\u003cbr\u003e3.\u0026nbsp; Cleartext Signature Plaintext Truncated for Hash Calculation -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/formfeed\"\u003ehttps://gpg.fail/formfeed\u003c/a\u003e\u003cbr\u003e4.\u0026nbsp; Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/malleability\"\u003ehttps://gpg.fail/malleability\u003c/a\u003e\u003cbr\u003e5.\u0026nbsp; Memory Corruption in ASCII-Armor Parsing -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/memcpy\"\u003ehttps://gpg.fail/memcpy\u003c/a\u003e\u003cbr\u003e6.\u0026nbsp; Trusted comment injection (minisign) -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/minisign\"\u003ehttps://gpg.fail/minisign\u003c/a\u003e\u003cbr\u003e7.\u0026nbsp; Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notdash\"\u003ehttps://gpg.fail/notdash\u003c/a\u003e\u003cbr\u003e8.\u0026nbsp; OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/notsoclear\"\u003ehttps://gpg.fail/notsoclear\u003c/a\u003e\u003cbr\u003e9.\u0026nbsp; GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/noverify\"\u003ehttps://gpg.fail/noverify\u003c/a\u003e\u003cbr\u003e10.\u0026nbsp; Cleartext Signature Forgery in GnuPG -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/nullbyte\"\u003ehttps://gpg.fail/nullbyte\u003c/a\u003e\u003cbr\u003e11.\u0026nbsp; Radix64 Line-Truncation Enabling Polyglot Attacks -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/polyglot\"\u003ehttps://gpg.fail/polyglot\u003c/a\u003e\u003cbr\u003e12.\u0026nbsp; GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/sha1\"\u003ehttps://gpg.fail/sha1\u003c/a\u003e\u003cbr\u003e13.\u0026nbsp; GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trust\"\u003ehttps://gpg.fail/trust\u003c/a\u003e\u003cbr\u003e14.\u0026nbsp; Trusted comment Injection (minisign) - \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gpg.fail/trustcomment\"\u003ehttps://gpg.fail/trustcomment\u003c/a\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
}
],
"value": "Reference to the\u00a0gpg.fail\n\n\n\n\n1.\u00a0 Multiple Plaintext Attack on Detached PGP Signatures in GnuPG -\u00a0 https://gpg.fail/detached \n2.\u00a0 GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field -\u00a0 https://gpg.fail/filename \n3.\u00a0 Cleartext Signature Plaintext Truncated for Hash Calculation -\u00a0 https://gpg.fail/formfeed \n4.\u00a0 Encrypted message malleability checks are incorrectly enforced causing plaintext recovery attacks -\u00a0 https://gpg.fail/malleability \n5.\u00a0 Memory Corruption in ASCII-Armor Parsing -\u00a0 https://gpg.fail/memcpy \n6.\u00a0 Trusted comment injection (minisign) -\u00a0 https://gpg.fail/minisign \n7.\u00a0 Cleartext Signature Forgery in the NotDashEscaped header implementation in GnuPG -\u00a0 https://gpg.fail/notdash \n8.\u00a0 OpenPGP Cleartext Signature Framework Susceptible to Format Confusion -\u00a0 https://gpg.fail/notsoclear \n9.\u00a0 GnuPG Output Fails To Distinguish Signature Verification Success From Message Content\u00a0 https://gpg.fail/noverify \n10.\u00a0 Cleartext Signature Forgery in GnuPG -\u00a0 https://gpg.fail/nullbyte \n11.\u00a0 Radix64 Line-Truncation Enabling Polyglot Attacks -\u00a0 https://gpg.fail/polyglot \n12.\u00a0 GnuPG may downgrade digest algorithm to SHA1 during key signature checking -\u00a0 https://gpg.fail/sha1 \n13.\u00a0 GnuPG Trust Packet Parsing Enables Adding Arbitrary Subkeys -\u00a0 https://gpg.fail/trust \n14.\u00a0 Trusted comment Injection (minisign) - https://gpg.fail/trustcomment"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"url": "https://gpg.fail/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Bundle reference to gpg.fail",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-0001"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"datePublished": "2026-01-02T10:20:00.000Z",
"dateUpdated": "2026-01-02T13:31:14.359346Z",
"requesterUserId": "00000000-0000-4000-9000-000000000000",
"serial": 1,
"state": "PUBLISHED",
"vulnId": "gcve-1-2026-0001",
"vulnerabilitylookup_history": [
[
"alexandre.dulaunoy@circl.lu",
"2026-01-02T10:20:24.357623Z"
],
[
"alexandre.dulaunoy@circl.lu",
"2026-01-02T10:20:45.873825Z"
],
[
"alexandre.dulaunoy@circl.lu",
"2026-01-02T13:28:12.107109Z"
],
[
"alexandre.dulaunoy@circl.lu",
"2026-01-02T13:31:14.359346Z"
]
]
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}