CVE-2026-57062 – GnuPG gpgsm AES-GCM ICV Length Validation Bypass

CVE ID :CVE-2026-57062

Published : June 23, 2026, 5:26 p.m. | 17 minutes ago

Description :CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

Severity: 2.9 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…