https://seclists.org/oss-sec/2026/q3/812: trospective by 'gpg.fail' authors
Affected Software
Frequently Asked Questions
Is normal gpgsm certificate importing affected?
The issue is described as requiring gpgsm to be run with --debug x509; the reported command used --debug all while importing a crafted certificate. The provided information does not indicate that a normal import without X.509 debugging triggers it.
What does an attacker need to exploit this?
An attacker would need a crafted certificate to be imported by an operator or process running gpgsm with X.509 debugging enabled. The affected debug path uses certificate DER data as a printf-style format string.
Has remote code execution been confirmed?
No. Testing with the referenced sample certificates reportedly produced no more than a segmentation fault, and the report states that a working RCE reproducer is needed.
What can be done before a fix is deployed?
Avoid running gpgsm with --debug x509 or --debug all when importing untrusted certificates. If debugging is necessary, do not process attacker-supplied or otherwise untrusted certificate files in that mode.
Which installations should be reviewed?
Review gpgsm versions later than 2.2 where operational scripts, support procedures, or users enable --debug x509 or the broader --debug all option during certificate imports.