CVE-2017-7526: Infoleak
Last updated 25 August 2025
Other sources
libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7526?
CVE-2017-7526 has been classified as a high severity vulnerability due to its potential to allow complete breakage of RSA-1024 and RSA-2048 implementations.
How do I fix CVE-2017-7526?
To mitigate CVE-2017-7526, upgrade to libgcrypt version 1.7.8 or later along with relevant updates to affected software packages.
Which software is affected by CVE-2017-7526?
CVE-2017-7526 affects libgcrypt versions before 1.7.8, as well as specific versions of gnupg1 and gnupg2 on Debian and Ubuntu distributions.
What impact does CVE-2017-7526 have on RSA encryption?
CVE-2017-7526 allows attackers to exploit cache side-channel vulnerabilities that can completely break RSA encryption implementations using affected versions.
When was CVE-2017-7526 disclosed?
CVE-2017-7526 was disclosed on July 24, 2024, although the vulnerability itself has existed in libgcrypt versions prior to 1.7.8.