Description
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GnuPG | GnuPG | 2.5.21 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | gnupg2 | No fix yet | — |
Advisories 1
- WID-SEC-2026-4215 GnuPG for Windows: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Benutzerrechten BSI CERT-Bund (WID) · Oct 29, 2026