CVE-2026-41990

MEDIUM4.0Memory safety

JSON export Create alert

Description

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

CVSS breakdown

CVSS 3.1

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected products

GnuPG / Libgcrypt1.12.0 – 1.12.2

References

MAILING_LISThttps://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html
MAILING_LISThttps://www.openwall.com/lists/oss-security/2026/04/21/1
MISChttps://dev.gnupg.org/T8208

Updated 17m ago · 8 sources