Description
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gnupg | Libgcrypt | 1.12.0 – < 1.12.2 | 1.12.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libgcrypt20 | 1.12.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libgcrypt20 | 1.12.0-2ubuntu0.1 | USN-8319-1 |
| Ubuntu 25.10 | libgcrypt20 | 1.11.0-7ubuntu0.1 | USN-8319-1 |
| Ubuntu 24.04 LTS | libgcrypt20 | 1.10.3-2ubuntu0.1 | USN-8319-1 |
| Ubuntu 22.04 LTS | libgcrypt20 | 1.9.4-3ubuntu3.2 | USN-8319-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro FIPS-updates 24.04 LTS | libgcrypt20 | 1.12.0-2ubuntu0.1~Fips1~rc11 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | libgcrypt +1 | 1.12.2-1.hum1 | RHSA-2026:8466 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libgcrypt | 1.12.1-160000.2.1 | SUSE-SU-2026:22355-1 |
| SLES 16.0 | libgcrypt | 1.12.1-160000.2.1 | SUSE-SU-2026:22355-1 |
| SLE Micro 6.2 | libgcrypt | 1.12.1-160000.2.1 | SUSE-SU-2026:22270-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | libgcrypt | 1.12.1-160000.2.1 | openSUSE-SU-2026:21047-1 |
Advisories 5
- RHSA-2026:8466 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SUSE-SU-2026:22355-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:22270-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:21047-1 Security update for libgcrypt SUSE / openSUSE Security Updates · Jun 30, 2026
- USN-8319-1 libgcrypt20 vulnerabilities Ubuntu Security Notices (USN) · May 27, 2026