p PatchFirst

CVE-2026-57062

CVE-2026-57062

This page contains facts from public vulnerability sources. Check the original advisory before updating.

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

CVSS 2.9 · Low · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • gnupg

    Versions
    • ≥ 0, ≤ 2.5.20: Affected (semver)

    No fix published

  • gnupg2 Debian:12

    Versions
    • 2.2.40-1.1
    • 2.2.40-1.1+deb12u1
    • 2.2.40-1.1+deb12u2
    • 2.2.40-1.1+hurd.1
    • 2.2.40-1.1+loong64
    • 2.2.40-2
    • 2.2.40-3
    • 2.2.43-1
    • 2.2.43-2
    • 2.2.43-3
    • 2.2.43-4
    • 2.2.43-5
    • 2.2.43-6
    • 2.2.43-7
    • 2.2.43-8
    • 2.2.44-1
    • 2.2.45-1
    • 2.2.45-2
    • 2.2.45-3
    • 2.2.46-1
    • 2.2.46-2
    • 2.2.46-3
    • 2.2.46-4
    • 2.2.46-5
    • 2.2.46-6
    • 2.2.46~pre1-1
    • 2.3.1-1
    • 2.4.3-2
    • 2.4.4-1
    • 2.4.4-2
    • 2.4.4-3
    • 2.4.4-4
    • 2.4.5-1
    • 2.4.5-2
    • 2.4.5-3
    • 2.4.6-1
    • 2.4.7-1
    • 2.4.7-10
    • 2.4.7-11
    • 2.4.7-12
    • 2.4.7-13
    • 2.4.7-14
    • 2.4.7-15
    • 2.4.7-16
    • 2.4.7-17
    • 2.4.7-18
    • 2.4.7-19
    • 2.4.7-2
    • 2.4.7-20
    • 2.4.7-21
    • 2.4.7-3
    • 2.4.7-4
    • 2.4.7-5
    • 2.4.7-6
    • 2.4.7-7
    • 2.4.7-8
    • 2.4.7-9
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    • 2.4.9-5
    • 2.4.9-6
    • 2.4.9-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Debian:13

    Versions
    • 2.4.7-21
    • 2.4.7-21+deb13u1
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    • 2.4.9-5
    • 2.4.9-6
    • 2.4.9-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Debian:14

    Versions
    • 2.4.7-21
    • 2.4.8-1
    • 2.4.8-2
    • 2.4.8-3
    • 2.4.8-4
    • 2.4.8-5
    • 2.4.8-6
    • 2.4.9-1
    • 2.4.9-2
    • 2.4.9-3
    • 2.4.9-4
    Affected ranges
    • ECOSYSTEM: < 2.4.9-5

    Update to 2.4.9-5

  • gnupg2 Ubuntu:24.04:LTS

    Versions
    • 2.2.40-1.1ubuntu1
    • 2.4.4-2ubuntu7
    • 2.4.4-2ubuntu15
    • 2.4.4-2ubuntu16
    • 2.4.4-2ubuntu17
    • 2.4.4-2ubuntu17.2
    • 2.4.4-2ubuntu17.3
    • 2.4.4-2ubuntu17.4
    Affected ranges
    • ECOSYSTEM: < 2.4.4-2ubuntu17.6

    Update to 2.4.4-2ubuntu17.6

  • gnupg2 Ubuntu:25.10

    Versions
    • 2.4.4-2ubuntu23
    • 2.4.4-2ubuntu24
    • 2.4.7-17ubuntu3
    • 2.4.8-2ubuntu1
    • 2.4.8-2ubuntu2
    • 2.4.8-2ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gnupg2 Ubuntu:26.04:LTS

    Versions
    • 2.4.8-2ubuntu2
    • 2.4.8-4ubuntu1
    • 2.4.8-4ubuntu2
    • 2.4.8-4ubuntu3
    Affected ranges
    • ECOSYSTEM: < 2.4.8-4ubuntu3.1

    Update to 2.4.8-4ubuntu3.1

Original sources

Check your server →