https://seclists.org/oss-sec/2026/q3/784: trospective by 'gpg.fail' authors

Q: Are standard production uses of gpgsm affected?

The reported issue requires gpgsm to be run with a debug option, specifically affecting versions later than 2.2 when using --debug x509. The debug interface is not intended for production use and may change at any time.

Q: Does the available certificate demonstrate remote code execution?

No confirmed reproducer is described. Testing with the certificates from the referenced Git repository produced at most a segmentation fault, and the reported remote-code-execution claim was considered unclear without a real reproducer.

Q: What is required to trigger the observed failure?

gpgsm must import a crafted certificate while X.509 debugging is enabled, such as gpgsm --debug all --import bad.cert. The certificate DER data reaches a logging call as a printf-style format string, resulting in garbled stderr output and potentially a crash.

Q: What can be done before an update is available?

Do not use --debug x509 or --debug all when importing untrusted certificates. The described code correction replaces the log_debug call with log_printhex for the certificate data.

Published Sep 15, 2026

Updated

Affected Software

2 affected components

gnupg gpgsm=2.4.9, >2.2<=2.4.9

libgcrypt=1.12.3

Frequently Asked Questions

Are standard production uses of gpgsm affected?

The reported issue requires gpgsm to be run with a debug option, specifically affecting versions later than 2.2 when using --debug x509. The debug interface is not intended for production use and may change at any time.

Does the available certificate demonstrate remote code execution?

No confirmed reproducer is described. Testing with the certificates from the referenced Git repository produced at most a segmentation fault, and the reported remote-code-execution claim was considered unclear without a real reproducer.

What is required to trigger the observed failure?

gpgsm must import a crafted certificate while X.509 debugging is enabled, such as gpgsm --debug all --import bad.cert. The certificate DER data reaches a logging call as a printf-style format string, resulting in garbled stderr output and potentially a crash.

What can be done before an update is available?

Do not use --debug x509 or --debug all when importing untrusted certificates. The described code correction replaces the log_debug call with log_printhex for the certificate data.