CVE-2026-41990
Libgcrypt before 1.12.2 mishandles Dilithium signing.
Published Apr 23, 2026 · updated Jun 17, 2026 · gnupg libgcrypt
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Apr 23, 2026 · NIST NVD
Detected
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
Jun 17, 2026 · NIST NVD
Updated
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
Affected
- cpe gnupg/libgcryptversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41990
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41990
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
nvd.nist.gov