Kleopatra
Monthly
Privilege escalation in KDE Kleopatra before 26.08.0 on Windows allows any local user to assume the operating system privileges of a currently-running Kleopatra process by exploiting a control-flow defect in the KUniqueService single-instance enforcement mechanism. The CVSS 6.9 rating reflects high confidentiality and integrity impact - access to private cryptographic keys and certificates is plausible - but is substantially offset by the local-only attack vector and high complexity (AC:H). No public exploit code has been identified and SSVC confirms exploitation is currently none, with an EPSS of 0.01% placing this in the bottom 2% of CVEs by exploitation likelihood; a vendor patch at 26.08.0 is available via the April 2026 KDE security advisory.
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Privilege escalation in KDE Kleopatra before 26.08.0 on Windows allows any local user to assume the operating system privileges of a currently-running Kleopatra process by exploiting a control-flow defect in the KUniqueService single-instance enforcement mechanism. The CVSS 6.9 rating reflects high confidentiality and integrity impact - access to private cryptographic keys and certificates is plausible - but is substantially offset by the local-only attack vector and high complexity (AC:H). No public exploit code has been identified and SSVC confirms exploitation is currently none, with an EPSS of 0.01% placing this in the bottom 2% of CVEs by exploitation likelihood; a vendor patch at 26.08.0 is available via the April 2026 KDE security advisory.
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.