CVE-2026-41989
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in Libgcrypt before version 1.12.2 allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext passed to gcry_pk_decrypt.
Risk Assessment
An attacker can remotely crash an application using Libgcrypt, leading to service disruption (DoS).
Recommendation
Immediately update Libgcrypt to version 1.12.2 or later.
Other vulnerabilities in Libgcrypt
See all- CVE-2017-0379High
Libgcrypt before version 1.8.1 does not properly consider Curve25519 side-channel attacks, making it easier for attackers to discover a secret key.
- CVE-2021-33560High
Vulnerability in Libgcrypt before versions 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption due to missing exponent blinding, enabling a side-channel attack on mpi_powm. Additionally, the window size is not chosen appropriately, increasing information leakage risk.
Original NVD description (English source)
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS