Libgcrypt EUVD-2026-25192

The vulnerability requires the attacker to supply a crafted ECDH ciphertext to code that calls gcry_pk_decrypt. No authentication is required (PR:N), and no user interaction is needed (UI:N), but exploitation is constrained by AC:H (high complexity): the attacker must construct a ciphertext that triggers the specific out-of-bounds write condition, which depends on internal buffer layout, heap state, and specific ECDH parameters. Exploitation is limited to local or local-network contexts where the attacker can feed the malicious ciphertext to the vulnerable process - remote exploitation requires the process to accept untrusted ECDH input from a network source. The vulnerability does NOT affect hardened deployments that validate ECDH ciphertext signatures, reject ciphertexts from untrusted parties, or run ECDH decryption in sandboxed/isolated contexts.

The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U) indicates local attack vector with high complexity, limiting real-world exploitability compared to network-based attacks. The impact severity (I:H/A:H) confirms high integrity and availability damage if exploitation succeeds. The AC:H (high complexity) rating suggests the attacker must satisfy non-trivial constraints - likely requiring specific heap layout conditions, particular ECDH parameters, or knowledge of the decryption function's internal buffering. The absence of both public exploit code and CISA KEV listing signals that while the vulnerability is real, it has not yet matured into widespread weaponization. Real-world risk depends heavily on deployment context: applications that accept untrusted ECDH ciphertexts (e.g., messaging protocols, key-exchange servers) face meaningful risk; static key scenarios or applications validating ciphertext source face lower risk. The CVSS score of 6.7 reflects moderate severity - not critical, but warranting timely patching given the memory-corruption class and potential for chained exploits.

An attacker crafts a malformed ECDH ciphertext and provides it to an application (e.g., a TLS implementation, messaging client, or key-agreement service) that calls gcry_pk_decrypt. Upon decryption, the function writes beyond the heap buffer, corrupting adjacent data structures. Depending on heap layout and attacker knowledge, this corruption causes a crash (denial of service) or, in a more sophisticated scenario, overwrites function pointers or metadata to achieve arbitrary code execution with the privileges of the vulnerable application.