Description
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gnupg | Libgcrypt | 1.8.8 – < 1.10.4, 1.11.0 – < 1.11.3, 1.12.0 – < 1.12.2 | 1.10.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgcrypt20 | 1.12.2-1 | — |
| Debian 13 | libgcrypt20 | 1.11.0-7+deb13u1 | — |
| Debian 12 | libgcrypt20 | 1.10.1-3+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libgcrypt20 | 1.12.0-2ubuntu0.1 | USN-8319-1 |
| Ubuntu 25.10 | libgcrypt20 | 1.11.0-7ubuntu0.1 | USN-8319-1 |
| Ubuntu 24.04 LTS | libgcrypt20 | 1.10.3-2ubuntu0.1 | USN-8319-1 |
| Ubuntu 22.04 LTS | libgcrypt20 | 1.9.4-3ubuntu3.2 | USN-8319-1 |
| Ubuntu 20.04 LTS | libgcrypt20 | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | libgcrypt20 | 1.12.0-2ubuntu0.1~Fips1~rc11 | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | libgcrypt20 | 1.9.4-3ubuntu3.2+Fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | libgcrypt20 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libgcrypt20 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libgcrypt +1 | 1.11.0-7.el10_2 | RHSA-2026:50144 |
| RHEL 9 | libgcrypt +1 | 1.10.0-13.el9_8 | RHSA-2026:50147 |
| RHEL 8 | libgcrypt +1 | 1.8.5-8.el8_10 | RHSA-2026:47117 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libgcrypt | 1.11.0-5.el10_0.1 | RHSA-2026:52951 |
| RHEL 9.6 EUS | libgcrypt | 1.10.0-11.el9_6.1 | RHSA-2026:52950 |
| RHEL 9.4 E4S | libgcrypt | 1.10.0-10.el9_4.2 | RHSA-2026:52952 |
| RHEL 9.2 E4S | libgcrypt | 1.10.0-10.el9_2.2 | RHSA-2026:52953 |
| RHEL 8.8 TUS | libgcrypt | 1.8.5-7.el8_8.1 | RHSA-2026:58977 |
| RHEL 8.8 E4S | libgcrypt | 1.8.5-7.el8_8.1 | RHSA-2026:58977 |
| RHEL 8.6 EUS Long Life | libgcrypt | 1.8.5-7.el8_6.1 | RHSA-2026:58978 |
| RHEL 8.6 AUS | libgcrypt | 1.8.5-7.el8_6.1 | RHSA-2026:58978 |
| RHEL 8.4 EUS Long Life | libgcrypt | 1.8.5-4.el8_4.1 | RHSA-2026:58979 |
| RHEL 8.4 AUS | libgcrypt | 1.8.5-4.el8_4.1 | RHSA-2026:58979 |
| Red Hat Hardened Images 1 | libgcrypt +1 | 1.12.2-1.hum1 | RHSA-2026:8466 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libgcrypt +1 | 1.11.0-7.el10_2 | ALSA-2026:50144 |
| AlmaLinux 9 | libgcrypt +1 | 1.10.0-13.el9_8 | ALSA-2026:50147 |
| AlmaLinux 8 | libgcrypt +1 | 1.8.5-8.el8_10 | ALSA-2026:47117 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libgcrypt | 1.11.0-7.el10_2 | RLSA-2026:50144 |
| Rocky Linux 9 | libgcrypt | 1.10.0-13.el9_8 | RLSA-2026:50147 |
| Rocky Linux 8 | libgcrypt | 1.8.5-8.el8_10 | RLSA-2026:47117 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libgcrypt | 1.11.0-150700.5.10.1 | SUSE-SU-2026:3182-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libgcrypt | 1.12.1-160000.3.1 | SUSE-SU-2026:22826-1 |
| SLES 16.0 | libgcrypt | 1.12.1-160000.3.1 | SUSE-SU-2026:22826-1 |
| SLE Micro 6.2 | libgcrypt | 1.12.1-160000.3.1 | SUSE-SU-2026:22760-1 |
| SLE Micro 6.1 | libgcrypt | 1.10.3-slfo.1.1_4.1 | SUSE-SU-2026:22907-1 |
| SLE Micro 6.0 | libgcrypt | 1.10.3-4.1 | SUSE-SU-2026:22919-1 |
| SLE Micro 5.5 | libgcrypt | 1.9.4-150500.12.6.1 | SUSE-SU-2026:3491-1 |
| SLE Micro 5.4 | libgcrypt | 1.9.4-150400.6.14.1 | SUSE-SU-2026:3921-1 |
| SLE Micro 5.3 | libgcrypt | 1.9.4-150400.6.14.1 | SUSE-SU-2026:3921-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | libgcrypt | 1.12.1-160000.3.1 | openSUSE-SU-2026:21387-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libgcrypt +1 | 1.10.2-1.amzn2023.0.3 | ALAS2023-2026-1705 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libgcrypt | 1.10.3-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libgcrypt +1 | 10:1.10.0-13.el9_8_fips | ELSA-2026-500145 |
| Oracle Linux 8 | libgcrypt +1 | 1.8.5-8.el8_10 | ELSA-2026-500138, ELSA-2026-47117 |
Advisories 41
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- SSA-457936 SSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7 Siemens ProductCERT · Nov 10, 2026
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:50147 Moderate: libgcrypt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:50144 Moderate: libgcrypt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:47117 Moderate: libgcrypt security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- ICSA-26-295-11 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Oct 22, 2026
- WID-SEC-2026-1267 Red Hat Hardened Images RPMs: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:8466 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:58979 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:58978 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:58977 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52953 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52952 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52950 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:52951 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:50147 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:50144 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:47117 Red Hat Security Advisory: libgcrypt security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 Siemens ProductCERT · Oct 13, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2026-3403 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 24, 2026
- NCSC-2026-0375 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Sep 16, 2026
- SUSE-SU-2026:3921-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Sep 10, 2026
- RLSA-2026:47117 Moderate: libgcrypt security update Rocky Linux Security Advisories · Aug 12, 2026
- ELSA-2026-500145 Moderate: libgcrypt security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 7, 2026
- RLSA-2026:50147 Moderate: libgcrypt security update Rocky Linux Security Advisories · Aug 6, 2026
- RLSA-2026:50144 Moderate: libgcrypt security update Rocky Linux Security Advisories · Aug 6, 2026
- ELSA-2026-500138 Moderate: libgcrypt security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 6, 2026
- SUSE-SU-2026:3491-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Aug 4, 2026
- ELSA-2026-47117 Moderate: libgcrypt security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
- SUSE-SU-2026:22907-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22919-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 28, 2026
- SUSE-SU-2026:22826-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 28, 2026
- ICSA-26-209-04 Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP CISA ICS & IT advisories · Jul 28, 2026
- openSUSE-SU-2026:21387-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:22760-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 23, 2026
- SUSE-SU-2026:3182-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 23, 2026
- USN-8319-1 libgcrypt20 vulnerabilities Ubuntu Security Notices (USN) · May 27, 2026
- ALAS2023-2026-1705 Moderate: libgcrypt security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 25, 2026