CVE-2026-118131
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
GnuPG version 2.5.21 for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. A low-privilege attacker can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components.
Risk Assessment
This can result in code execution within the security context of the victim user, posing a serious threat to system confidentiality and integrity.
Recommendation
Update GnuPG to the patched version and restrict permissions on C:\ProgramData and its subdirectories according to vendor guidance.
Other vulnerabilities in GnuPG
See all- CVE-2019-14855Low
A flaw in GnuPG before version 2.2.18 allows certificate signature forgery using SHA-1 collision attacks. An attacker can create forged certificate signatures, compromising authentication integrity.
- CVE-2026-105712Low
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (-C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions.
- CVE-2026-24882High
In GnuPG before version 2.5.17, a stack-based buffer overflow exists in the tpm2daemon component during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
- CVE-2026-24881High
In GnuPG before version 2.5.17, a crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can lead to denial of service, but also memory corruption that could result in remote code execution.
- CVE-2025-68972Medium
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Original NVD description (English source)
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS