2.9
Low
CVE-2026-57062 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM…
Description
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GnuPG 2.5 | earliest → 2.5.20 | No fix stated |
References
- blog.calif.io blog.calif.io
- www.gnupg.org www.gnupg.org
Timeline
- Published
- Last modified
Other CVEs of GnuPG
The 9 CVEs of GnuPG →
CVE-2026-118131
CVE-2026-118131
9.8
Critical
CVE-2026-105712
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive
3.6
Low
CVE-2026-24883
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set…
3.7
Low
CVE-2026-24882
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command…
8.4
High