Cyber Posture

CVE-2026-41989

Medium

Published: 23 April 2026

Published
23 April 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0001 3.4th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Description

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

Security SummaryAI

CVE-2026-41989 is a heap-based buffer overflow vulnerability (CWE-787) affecting Libgcrypt versions before 1.12.2. The flaw occurs when the gcry_pk_decrypt function processes crafted ECDH ciphertext, potentially leading to a denial of service. Published on 2026-04-23, it carries a CVSS v3.1 base score of 6.7 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), highlighting medium severity with impacts primarily on integrity and availability.

Exploitation requires local access (AV:L) and high attack complexity (AC:H), but no privileges (PR:N), user interaction (UI:N), or scope change (S:U). An unprivileged local attacker could supply malformed ECDH ciphertext to trigger the buffer overflow in gcry_pk_decrypt, achieving high integrity violation (I:H)—such as memory corruption—and high availability disruption (A:H), like application crashes or denial of service, with no confidentiality impact (C:N).

Advisories recommend upgrading to Libgcrypt 1.12.2, which addresses the issue. Detailed information is available in the GnuPG development ticket at https://dev.gnupg.org/T8211, the GnuPG announce mailing list post at https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html, and the OSS-Security mailing list discussion at https://www.openwall.com/lists/oss-security/2026/04/21/1.

Details

CWE(s)

Affected Products

gnupg
libgcrypt
1.8.8 — 1.10.4 · 1.11.0 — 1.11.3 · 1.12.0 — 1.12.2

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Heap buffer overflow in gcry_pk_decrypt enables local memory corruption leading to application crashes/DoS via crafted ECDH input (matches Application or System Exploitation sub-technique).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

References