ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41989

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Published Apr 23, 2026 · updated Oct 15, 2026 · gnupg libgcrypt

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 23, 2026 · NIST NVD

    Detected

    Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

  2. Oct 15, 2026 · NIST NVD

    Updated

    Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Affected

  • cpe gnupg/libgcryptversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-41989

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-41989

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-41989

    Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

    nvd.nist.gov

References