GnuPG libgcrypt vulnerabilities

3 published CVEs name GnuPG libgcrypt among the affected products.

Critical 0High 0Medium 3Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-41990
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
gnupg · Libgcrypt
Medium4.0
CVE-2026-41989
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
gnupg · Libgcrypt
Medium6.7
CVE-2017-7526
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method…
GnuPG · libgcrypt
Medium6.1