GnuPG for Windows inherits insecure permissions on ProgramData
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-427.
Summary
GnuPG 2.5.21 for Windows inherits default permissions on the C:\ProgramData directory that let members of the BUILTIN\Users group create subdirectories there. A low-privilege attacker can create the GnuPG configuration directory and place malicious configuration files that GnuPG components read, which results in code execution in the victim user's security context. The flaw is tracked as CWE-732.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GnuPG. Red Hat lists Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 as affected with no fix plan available, and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-27 Threatist record created from CVE-2026-118131
- 2026-10-27 Alias added: GHSA-c8cg-36rg-65fq
- 2026-11-04 CVSS score added · CISA ADP
- 2026-11-04 Weakness changed · CISA ADP
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: LOW → MEDIUM
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More GnuPG vulnerabilities
- TI-2022-03243 Integer overflow in libksba CVSS 3.1CRITICAL 9.8
- TI-2025-42429 Out-of-bounds write in GnuPG CVSS 3.1HIGH 7.8
- TI-2025-42428 Improper signature verification in GnuPG CVSS 3.1MEDIUM 5.9
- TI-2008-01464 GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash)… CVSS 2.0HIGH 9.3
- TI-2026-20067 Stack-based buffer overflow in GnuPG CVSS 3.1CRITICAL 9.8
- TI-2022-23657 Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-118131 · CVE Program
- CVE-2026-118131 · NVD
- FIRST EPSS
- GHSA-c8cg-36rg-65fq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118131 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences