Skip to main content

Libgcrypt EUVDEUVD-2026-25193

| CVE-2026-41990 MEDIUM
Out-of-bounds Write (CWE-787)
2026-04-23 mitre GHSA-78pv-qq8x-94px
Buffer Overflow Memory Corruption Red Hat Gnupg Suse Libgcrypt
4.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.0 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
SUSE
3.6 LOW
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat
3.3 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

6
Patch released
Apr 27, 2026 - 18:33 nvd
Patch available
Analysis Generated
Apr 23, 2026 - 07:08 vuln.today
Patch available
Apr 23, 2026 - 06:16 EUVD
EUVD ID Assigned
Apr 23, 2026 - 05:00 euvd
EUVD-2026-25193
Analysis Generated
Apr 23, 2026 - 05:00 vuln.today
CVE Published
Apr 23, 2026 - 04:39 nvd
MEDIUM 4.0

DescriptionCVE.org

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

AnalysisAI

Libgcrypt before version 1.12.2 contains a bounds-check vulnerability in Dilithium signing operations where writes to a static array lack proper bounds validation, potentially causing memory corruption and integrity loss. The vulnerability affects local attackers with non-privileged access on systems running vulnerable versions 1.12.0 and 1.12.1. While the vulnerability does not involve attacker-controlled data in the array writes themselves, the missing bounds check creates an integrity and availability risk through uncontrolled memory modification.

Technical ContextAI

Libgcrypt is the cryptographic library underlying GnuPG and other applications requiring cryptographic primitives. This vulnerability resides in the Dilithium signature algorithm implementation (NIST FIPS 204 post-quantum cryptography standard). The root cause is classified as CWE-787 (Out-of-bounds Write) - specifically, a static array used during Dilithium signing receives writes without validating that indices remain within allocated bounds. Although the vulnerability description notes that attacker-controlled data is not directly used in the array indexing, the lack of bounds enforcement means that legitimate code paths with certain input parameters can write beyond the array's boundaries, corrupting adjacent memory.

RemediationAI

Vendor-released patch: Libgcrypt 1.12.2 or later. Update the Libgcrypt library package immediately through your distribution's package manager (apt, yum, pacman, etc.) or download directly from https://dev.gnupg.org/. Rebuilding dependent applications (GnuPG, OpenSSL, or custom applications linked against Libgcrypt) may be necessary after the library upgrade. If immediate patching is not possible, restrict local system access to untrusted users and monitor for memory corruption errors in application logs; however, this does not eliminate the underlying risk and should be treated as temporary only. Verify successful patching by confirming Libgcrypt version with libgcrypt-config --version returns 1.12.2 or higher.

More in Gnupg

View all
CVE-2026-24881 CRITICAL POC
9.8 Jan 27

Remote code execution and denial of service in GnuPG before 2.5.17 stem from a stack-based buffer overflow in gpg-agent

CVE-2018-1000858 HIGH POC
8.8 Dec 20

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in At
CVE-2018-6829 HIGH POC
7.5 Feb 07

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, whic
CVE-2026-24882 HIGH POC
7.8 Jan 27

Stack-based buffer overflow in GnuPG's tpm2daemon (versions before 2.5.17) allows a local attacker to corrupt the daemon
CVE-2020-25125 HIGH POC
7.8 Sep 03

GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other imp
CVE-2019-13050 HIGH POC
7.5 Jun 29

Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes i
CVE-2022-34903 MEDIUM POC
6.5 Jul 01

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyrin
CVE-2012-6085 MEDIUM POC
5.8 Jan 24

The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, all
CVE-2021-40528 MEDIUM POC
5.9 Sep 06

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two c
CVE-2022-47629 CRITICAL
9.8 Dec 20

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Rated critical severity

CVE-2014-9087 HIGH
7.5 Dec 01

Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to

CVE-2018-0495 MEDIUM POC
4.7 Jun 13

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Fixed
SLES15-SP6-CHOST-BYOS Fixed
SLES15-SP6-CHOST-BYOS-Aliyun Fixed
SLES15-SP6-CHOST-BYOS-Azure Fixed
SLES15-SP6-CHOST-BYOS-EC2 Fixed

Share

EUVD-2026-25193 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy