CVE-2026-57062: Low severity gnupg gpgsm vulnerability
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.9-3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57062?
The severity of CVE-2026-57062 is classified as low with a score of 2.9.
How does CVE-2026-57062 affect GnuPG?
CVE-2026-57062 affects GnuPG by mishandling the AES-GCM CMS format due to accepting an incorrect length of 4 bytes instead of the required 12 bytes for aes-ICVlen.
What versions of GnuPG are impacted by CVE-2026-57062?
CVE-2026-57062 impacts GnuPG through version 2.5.20 of gpgsm.
What is the cause of CVE-2026-57062?
The cause of CVE-2026-57062 is improper parsing of the CMS format in GnuPG's gpgsm component.
Are there any known fixes for CVE-2026-57062?
As of now, there are no specific fixes mentioned for CVE-2026-57062, but users are advised to monitor updates from GnuPG.