CVE-2026-57062 Other in GnuPG
GnuPG's gpgsm incorrectly accepts short AES-GCM integrity tags, potentially allowing attackers to bypass cryptographic integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57062?
CVE-2026-57062 is a low-severity vulnerability in GnuPG, published on 23 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
Weakness: CWE-1284
Which versions are affected by CVE-2026-57062?
Linux distribution packages (19)
gnupg2 Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-dirmngr Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-g13 Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-gpg-agent Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-gpgconf Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-keyboxd Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-scdaemon Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-smime Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-utils Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-verify Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gnupg2-wks Red Hat:hummingbird:1 | All versions | 0:2.4.9-18.3.hum1 |
gpg2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 2.4.4-150600.3.18.1 |
gpg2 SUSE:Linux Enterprise Server 16.0 | All versions | 2.5.5-160000.6.1 |
gpg2 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.5.5-160000.6.1 |
gpg2 SUSE:Linux Micro 6.0 | All versions | 2.4.4-9.1 |
gpg2 SUSE:Linux Micro 6.1 | All versions | 2.4.4-slfo.1.1_9.1 |
gpg2 SUSE:Linux Micro 6.2 | All versions | 2.5.5-160000.6.1 |
gpg2 openSUSE:Leap 16.0 | All versions | 2.5.5-160000.6.1 |
gpg2 openSUSE:Tumbleweed | All versions | 2.5.21-1.1 |
How do I fix CVE-2026-57062?
Upgrade to a fixed version.
Is CVE-2026-57062 being exploited?
There is no known exploitation of CVE-2026-57062 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as AZL-91170, BELL-CVE-2026-57062, CLSA-2026-1785557084, CLSA-2026-1786609750, DEBIAN-CVE-2026-57062, ECHO-89c6-c3e9-d8d2 and 15 more.