CVE-2026-57062

Published: Jun 23, 2026Modified: Jun 25, 2026

2.9

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.4 / Impact: 1.4

Source: MITRE (Secondary)

Description

CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

Related CWEs

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (2)

https://blog.calif.io/p/how-to-format-a-ciphertext

Source: cve@mitre.org

https://www.gnupg.org/download/

Source: cve@mitre.org

Timeline

No history available yet.