Read the docs
TI-2026-30383 Aliases CVE-2026-41989GHSA-wrv8-79m2-qg24

Out-of-bounds write in GnuPG Libgcrypt

Priority LOW 29CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Fix Fixed Libgcrypt (gnupg): 1.10.4, 1.11.3, 1.12.2Red Hat: 44 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GnuPGLibgcrypt1.8.8 to before 1.10.4; 1.11.0 to before 1.11.3; 1.12.0 to before 1.12.21.10.4, 1.11.3, 1.12.2Patch availableCNA
  • Libgcrypt VendorGnuPG Affected 1.8.8 to before 1.10.4; 1.11.0 to before 1.11.3; 1.12.0 to before 1.12.2 Fixed in 1.10.4, 1.11.3, 1.12.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*1.8.8 to before 1.10.4; 1.11.0 to before 1.11.3; 1.12.0 to before 1.12.2VulnerableGnuPG
  • cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:* Versions 1.8.8 to before 1.10.4; 1.11.0 to before 1.11.3; 1.12.0 to before 1.12.2 Vulnerable ·GnuPG

Remediation

  • Fix · CNA Libgcrypt (gnupg) Fixed in 1.10.4, 1.11.3, 1.12.2

Red Hat 44 advisories

  • RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 41 more Red Hat advisories
  • RHSA-2026:82371 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference 3.5.2 (spyre)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-spyre-rhel9
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82336 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.1
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82061 Released 2026-10-13 · Red Hat rating Critical
    Red Hat AI Inference Tech Preview 3.5.2 (Gaudi)
    • Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/vllm-gaudi-rhel9
  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:58977 Released 2026-08-24 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libgcrypt-1.8.5-7.el8_8.1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libgcrypt-1.8.5-7.el8_8.1
  • RHSA-2026:58978 Released 2026-08-24 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libgcrypt-1.8.5-7.el8_6.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) libgcrypt-1.8.5-7.el8_6.1
  • RHSA-2026:58979 Released 2026-08-24 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libgcrypt-1.8.5-4.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libgcrypt-1.8.5-4.el8_4.1
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:54387 Released 2026-08-12 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:47117 Released 2026-08-12 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS (v. 8) libgcrypt-1.8.5-8.el8_10, libgcrypt-devel-1.8.5-8.el8_10
  • RHSA-2026:53371 Released 2026-08-11 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2026:52950 Released 2026-08-10 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libgcrypt-1.10.0-11.el9_6.1
  • RHSA-2026:52953 Released 2026-08-10 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libgcrypt-1.10.0-10.el9_2.2
  • RHSA-2026:52952 Released 2026-08-10 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.4) libgcrypt-1.10.0-10.el9_4.2
  • RHSA-2026:52951 Released 2026-08-10 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libgcrypt-1.11.0-5.el10_0.1
  • RHSA-2026:50147 Released 2026-08-04 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux AppStream (v. 9) libgcrypt-devel-1.10.0-13.el9_8
    • Red Hat Enterprise Linux BaseOS (v. 9) libgcrypt-1.10.0-13.el9_8
  • RHSA-2026:50144 Released 2026-08-04 · Red Hat rating Moderate
    libgcrypt security update
    • Red Hat Enterprise Linux AppStream (v. 10) libgcrypt-devel-1.11.0-7.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) libgcrypt-1.11.0-7.el10_2
  • RHSA-2026:8466 Released 2026-04-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images libgcrypt-1.12.2-1.hum1@aarch64, libgcrypt-1.12.2-1.hum1@src, libgcrypt-1.12.2-1.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82336, RHSA-2026:82888
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476, RHSA-2026:72502
Red Hat AI Inference Server 3.5Fixed RHSA-2026:82061, RHSA-2026:82371
Red Hat Discovery 2Fixed RHSA-2026:54760
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:50144
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:50147
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:50144
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:47117
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:50147
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:58979
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:58978
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:58977
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:52953
Red Hat Enterprise Linux BaseOS E4S (v.9.4)Fixed RHSA-2026:52952
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:52951
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:52950
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:58979
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)Fixed RHSA-2026:58978
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:58977
Red Hat Hardened ImagesFixed RHSA-2026:8466
Red Hat Insights proxy 1.5Fixed RHSA-2026:53371
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat Update Infrastructure 5Fixed RHSA-2026:54387, RHSA-2026:58981
Not affected: 23 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0)
  • Red Hat Enterprise Linux AppStream EUS (v.9.6)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4)
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6)
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0)
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41989
  2. 2026-10-03 Alias added: GHSA-wrv8-79m2-qg24
  3. 2026-10-13 Fix available: RHSA-2026:82061 · Red Hat
  4. 2026-10-13 Fix available: Red Hat AI Inference Server 3.5 · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82371 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  7. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  8. 2026-10-14 Fix available: RHSA-2026:82336 · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  11. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  12. 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
  13. 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
  14. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
  15. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 2

Other 1

  • TI-2021-12953 Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it… CVSS 3.1HIGH 7.5
  • TI-2017-00354 Information disclosure in libgcrypt CVSS 3.0HIGH 7.5
  • TI-2017-05168 Information disclosure in GnuPG libgcrypt CVSS 3.0MEDIUM 6.8
  • TI-2021-02343 _gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based… CVSS 3.1HIGH 7.8
  • TI-2018-04986 cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly… CVSS 3.0HIGH 7.5
  • TI-2019-09661 In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload… CVSS 3.1MEDIUM 5.9
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences