{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-41990", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-04-23T04:39:04.114Z", "datePublished": "2026-04-23T04:39:04.524Z", "dateUpdated": "2026-04-23T16:22:42.096Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Libgcrypt", "vendor": "gnupg", "versions": [{"lessThan": "1.12.2", "status": "affected", "version": "1.12.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-23T05:10:55.346Z"}, "references": [{"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"}, {"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"}, {"url": "https://dev.gnupg.org/T8208"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.12.0", "versionEndExcluding": "1.12.2"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T15:58:26.094245Z", "id": "CVE-2026-41990", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T16:22:42.096Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41990", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T15:58:26.094245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T15:58:31.312Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "gnupg", "product": "Libgcrypt", "versions": [{"status": "affected", "version": "1.12.0", "lessThan": "1.12.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"}, {"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"}, {"url": "https://dev.gnupg.org/T8208"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.12.2", "versionStartIncluding": "1.12.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-23T05:10:55.346Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41990", "state": "PUBLISHED", "dateUpdated": "2026-04-23T16:22:42.096Z", "dateReserved": "2026-04-23T04:39:04.114Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-23T04:39:04.524Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD6AEDAC-5EDC-4918-877A-A16792DB52A2", "versionEndExcluding": "1.12.2", "versionStartIncluding": "1.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data."}], "id": "CVE-2026-41990", "lastModified": "2026-04-27T18:33:27.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.4, "impactScore": 2.5, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-04-23T05:16:05.897", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://dev.gnupg.org/T8208"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Release Notes"], "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Release Notes"], "url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "Libgcrypt: Libgcrypt: Denial of Service or data integrity issues from missing bounds check during Dilithium signing.", "id": "2461068", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461068"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Libgcrypt. During Dilithium signing operations, the library fails to perform a bounds check when writing to a static array. While the data involved is not directly controlled by an attacker, this vulnerability could lead to memory corruption, potentially resulting in a denial of service (DoS) or affecting data integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-41990", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "libgcrypt", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-04-23T04:39:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-41990\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41990\nhttps://dev.gnupg.org/T8208\nhttps://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html\nhttps://www.openwall.com/lists/oss-security/2026/04/21/1"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.12.0,1.12.2)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Libgcrypt", "source": "cna", "vendor": "gnupg"}, "product": "libgcrypt", "vendor": "gnupg"}], "analysis": {"en": {"generated_at": "2026-04-28T23:51:56.874014+00:00", "value": {"mitigation_remediation": ["Upgrade Libgcrypt to version 1.12.2 or later", "Verify that all packages depending on Libgcrypt are updated so the vulnerable library is replaced", "Restart any services or applications that use Libgcrypt to clear cached state and confirm stable operation"], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Libgcrypt library that is bundled with GnuPG. Any installation using Libgcrypt older than 1.12.2 is subject to the flaw.", "description_and_impact": "Libgcrypt before version 1.12.2 performs a write to a static array without validating the bounds of the write. Because the data written is not supplied by an attacker, the flaw does not provide a direct remote code execution or information disclosure path. Nonetheless the out\u2011of\u2011bounds write can corrupt memory and cause the process to crash, which results in a denial of service for services relying on Libgcrypt for signature generation.", "risk_and_exploitability": "The CVSS score of 4.0 reflects a low\u2011medium severity assessment, and the EPSS score of less than 1% indicates an extremely low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the memory corruption is triggered by static data that is not attacker\u2011controlled, it is unlikely that an attacker can reliably leverage the out\u2011of\u2011bounds write to achieve a purposeful outcome. The risk is therefore limited to potential local crashes, and the attack vector is inferred to be local or confined to the process using the library."}}}}, "created": "2026-04-28T05:00:13.795296+00:00", "updated": "2026-04-29T00:00:13.828326+00:00", "vendors": ["gnupg", "gnupg$PRODUCT$libgcrypt"]}