Vulnerability in GnuPG

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.8

[ Description ]Official description

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4215

  GnuPG for Windows: Vulnerability allows arbitrary code execution with user rights Translated from German

  CVE-2026-118131

[ References ]References

• atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtim…