CVE-2026-57062

EUVD-2026-38550
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
2.9 LOW
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gnupggnupg
𝑥
≤ 2.5.20
CNA
Debian logo
Debian Releases
Debian Product
Codename
gnupg2
bookworm
postponed
bullseye
2.2.27-2+deb11u2
fixed
bullseye (security)
2.2.27-2+deb11u3
fixed
forky
2.4.9-7
fixed
sid
2.4.9-7
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gnupg2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
dirmngr
suse enterprise desktop 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise sap 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise server 15 SP7
2.4.4-150600.3.18.1
fixed
gpg2
suse enterprise desktop 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise sap 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise server 15 SP7
2.4.4-150600.3.18.1
fixed
gpg2-lang
suse enterprise desktop 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise sap 15 SP7
2.4.4-150600.3.18.1
fixed
suse enterprise server 15 SP7
2.4.4-150600.3.18.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
gnupg2
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-debuginfo
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-debugsource
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-minimal
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-minimal-debuginfo
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-smime
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
gnupg2-smime-debuginfo
Amazon Linux 2023
0:2.3.7-1.amzn2023.0.9
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
gnupg2
Azure Linux 3.0
0:2.4.9-3.azl3
fixed
Common Weakness Enumeration
References
https://blog.calif.io/p/how-to-format-a-ciphertext
https://www.gnupg.org/download/