EUVD-2026-38550
GHSA-m6x2-4hhh-669j
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CMS messages are delivered over network channels such as email (AV:N); crafting a valid malformed ICV requires expertise (AC:H); a user must trigger gpgsm processing (UI:R); no confidentiality impact is supported by the description.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
AnalysisAI
GnuPG's gpgsm component through version 2.5.20 improperly validates AES-GCM authentication tag length during CMS parsing, accepting a 4-byte ICV where the cryptographic standard mandates 12 bytes. This validation failure means gpgsm will process CMS-formatted messages with a truncated integrity check value, undermining the authentication guarantee that AES-GCM is specifically designed to provide. No public exploit has been identified at time of analysis; the low CVSS score of 2.9 reflects constrained attack conditions, though the related CVE-2026-34182 warrants cross-referencing as it may share the same code path.
Technical ContextAI
CMS (Cryptographic Message Syntax, RFC 5652) is the format underlying S/MIME encrypted email and PKCS#7 structures. AES-GCM (AES in Galois/Counter Mode) is an authenticated encryption scheme whose security depends critically on the integrity check value (ICV), also known as the authentication tag. Per NIST SP 800-38D and the CMS AES-GCM extension RFCs, the ICV must be 12 bytes (96 bits) to ensure negligible forgery probability. The affected component, gpgsm, is GnuPG's implementation for S/MIME and CMS operations. CPE cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:* covers all GnuPG releases through 2.5.20. CWE-1284 (Improper Validation of Specified Quantity in Input) precisely characterizes the root cause: the parser accepts a user-controlled length field (aes-ICVlen) without enforcing the required 12-byte minimum, allowing a 4-byte value to pass unchallenged.
RemediationAI
The primary remediation is to upgrade GnuPG to a version released after 2.5.20 that addresses this ICV length validation flaw; consult the official GnuPG download page at https://www.gnupg.org/download/ for the latest release, as no specific patched version number was confirmed in the available intelligence data. If an immediate upgrade is not feasible, a targeted compensating control is to restrict gpgsm from processing CMS-formatted AES-GCM content sourced from untrusted external parties - for example, disable automatic S/MIME decryption for inbound email from external senders, accepting the trade-off of requiring manual processing or alternative tooling. Additionally, CVE-2026-34182 is explicitly noted as related and should be investigated and remediated concurrently, as it may share the same vulnerable code path.
Remote code execution and denial of service in GnuPG before 2.5.17 stem from a stack-based buffer overflow in gpg-agent
GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in At
cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, whic
Stack-based buffer overflow in GnuPG's tpm2daemon (versions before 2.5.17) allows a local attacker to corrupt the daemon
GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other imp
Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes i
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyrin
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, all
The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two c
Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Rated critical severity
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today