p PatchFirst

CVE-2026-118131

CVE-2026-118131

This page contains facts from public vulnerability sources. Check the original advisory before updating.

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.

EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • gnupg

    Versions
    • 2.5.21: Affected

    No fix published

  • gnupg2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.28-3ubuntu1
    • 2.0.28-3ubuntu2
    • 2.1.11-6ubuntu1
    • 2.1.11-6ubuntu2
    • 2.1.11-6ubuntu2.1
    • 2.1.11-6ubuntu2.1+esm1
    • 2.1.11-6ubuntu2.1+esm2
    • 2.1.11-6ubuntu2.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.1.15-1ubuntu8
    • 2.2.4-1ubuntu1
    • 2.2.4-1ubuntu1.1
    • 2.2.4-1ubuntu1.2
    • 2.2.4-1ubuntu1.3
    • 2.2.4-1ubuntu1.4
    • 2.2.4-1ubuntu1.5
    • 2.2.4-1ubuntu1.6
    • 2.2.4-1ubuntu1.6+esm1
    • 2.2.4-1ubuntu1.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:Pro:20.04:LTS

    Versions
    • 2.2.12-1ubuntu3
    • 2.2.17-3ubuntu1
    • 2.2.19-3ubuntu2
    • 2.2.19-3ubuntu2.1
    • 2.2.19-3ubuntu2.2
    • 2.2.19-3ubuntu2.4
    • 2.2.19-3ubuntu2.5
    • 2.2.19-3ubuntu2.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:22.04:LTS

    Versions
    • 2.2.20-1ubuntu4
    • 2.2.27-2ubuntu1
    • 2.2.27-3ubuntu1
    • 2.2.27-3ubuntu2
    • 2.2.27-3ubuntu2.1
    • 2.2.27-3ubuntu2.3
    • 2.2.27-3ubuntu2.4
    • 2.2.27-3ubuntu2.5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:24.04:LTS

    Versions
    • 2.2.40-1.1ubuntu1
    • 2.4.4-2ubuntu7
    • 2.4.4-2ubuntu15
    • 2.4.4-2ubuntu16
    • 2.4.4-2ubuntu17
    • 2.4.4-2ubuntu17.2
    • 2.4.4-2ubuntu17.3
    • 2.4.4-2ubuntu17.4
    • 2.4.4-2ubuntu17.6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:26.10

    Versions
    • 2.4.8-4ubuntu3
    • 2.4.9-4ubuntu1
    • 2.4.9-4ubuntu2
    • 2.4.9-4ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:26.04:LTS

    Versions
    • 2.4.8-2ubuntu2
    • 2.4.8-4ubuntu1
    • 2.4.8-4ubuntu2
    • 2.4.8-4ubuntu3
    • 2.4.8-4ubuntu3.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →