Summary
It was discovered that GnuPG incorrectly validated authentication tag
lengths when parsing CMS messages encrypted with AES-GCM. An attacker could
possibly use this issue to bypass message integrity checks.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | gnupg2 | 2.4.4-2ubuntu17.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | gnupg2 | 2.4.8-4ubuntu3.1 |
Vulnerabilities 1
-
Low 2.9CVE-2026-57062 Public exploit
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM becau…
References
-
report
https://ubuntu.com/security/CVE-2026-57062