CVE-2026-118131: Gnupg GnuPG vulnerability
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privilege access to the affected Windows system and membership in the BUILTIN\Users group. They can create directories under C:\ProgramData and place malicious files in the GnuPG configuration path.
Is a non-default Windows configuration required?
No. The issue is described as relying on default DACL inheritance on C:\ProgramData, which permits BUILTIN\Users members to create arbitrary subdirectories there.
What is required for code execution to occur?
The attacker must create the expected GnuPG configuration directory and inject malicious configuration files that are later consumed by GnuPG components. Code execution occurs in the security context of the victim user.
How can administrators identify systems exposed to this behavior?
Check whether GnuPG version 2.5.21 for Windows is installed and whether untrusted low-privilege users can create the expected GnuPG configuration directory beneath C:\ProgramData. Also review that location for unexpected directories or configuration files created by non-administrative users.