CVE-2026-57062
Fixed in a distro release EPSS <1%CVSS 2.9
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
Products: gnupg
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | gnupg2 | 2.3.7-1.amzn2023.0.9 |
| Amazon Linux 2023 | gnupg2-minimal | 2.3.7-1.amzn2023.0.9 |
| Amazon Linux 2023 | gnupg2-smime | 2.3.7-1.amzn2023.0.9 |
| Chainguard | gnupg | 2.4.9-r10 |
| Debian 12 | gnupg2 | no fix |
| Debian 13 | gnupg2 | no fix |
| Debian 14 | gnupg2 | 2.4.9-5 |
| Red Hat hummingbird 1 | gnupg2 | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-dirmngr | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-g13 | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-gpg-agent | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-gpgconf | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-keyboxd | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-scdaemon | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-smime | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-utils | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-verify | 0:2.4.9-18.3.hum1 |
| Red Hat hummingbird 1 | gnupg2-wks | 0:2.4.9-18.3.hum1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | gpg2 | 2.4.4-150600.3.18.1 |
| SUSE Linux Enterprise Server 16.0 | gpg2 | 2.5.5-160000.6.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | gpg2 | 2.5.5-160000.6.1 |
| SUSE Linux Micro 6.0 | gpg2 | 2.4.4-9.1 |
| SUSE Linux Micro 6.1 | gpg2 | 2.4.4-slfo.1.1_9.1 |
| SUSE Linux Micro 6.2 | gpg2 | 2.5.5-160000.6.1 |
| Ubuntu 24.04 LTS | gnupg2 | 2.4.4-2ubuntu17.6 |
| Ubuntu 25.10 | gnupg2 | no fix |
| Ubuntu 26.04 LTS | gnupg2 | 2.4.8-4ubuntu3.1 |
| Wolfi | gnupg | 2.4.9-r10 |
| openSUSE Leap 16.0 | gpg2 | 2.5.5-160000.6.1 |
| openSUSE Tumbleweed | gpg2 | 2.5.21-1.1 |