CVE-2026-41989

MEDIUM EPSS 7.8%
Published Apr 23, 20262mo ago · Modified Jun 17, 20262w ago
6.7 CVSS 3.1
Medium
Find Similar
Published Apr 23, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

CVSS Details

Base Score
6.7
Exploitability
1.4
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
7.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 3

VendorProductVersionRange
gnupglibgcrypt*≥1.8.8  –  <1.10.4
gnupglibgcrypt*≥1.11.0  –  <1.11.3
gnupglibgcrypt*≥1.12.0  –  <1.12.2

References 3

  • dev.gnupg.org https://dev.gnupg.org/T8211
    Broken Link
  • lists.gnupg.org https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html
    Third Party Advisory
  • openwall.com https://www.openwall.com/lists/oss-security/2026/04/21/1
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.