A bug found in libksba, the library used by GnuPG for parsing the ASN.1 structures as used by S/MIME. The bug affects all versions of Libksba before 1.6.2 and may be used for remote code execution.
https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html https://dev.gnupg.org/T6230 https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b https://lwn.net/Articles/911467/
From libksba-1.8.0 vs libksba-1.8.1:
@@ -1,3 +1,11 @@ +Noteworthy changes in version 1.8.1 (2026-08-24) [C24/A16/R1] +------------------------------------------------ + + Fix CMS parser to avoid possible infinite loop. [T8361] + + Release-info: https://dev.gnupg.org/T8253
The fix is:
commit 06720f9b16a172404f49089cbb6eb95e4344f562 Author: NIIBE Yutaka <gniibe () fsij org> AuthorDate: Thu Jul 30 14:18:27 2026 +0900 Commit: NIIBE Yutaka <gniibe () fsij org> CommitDate: Thu Jul 30 14:28:38 2026 +0900
Fix CMS parser to avoid possible infinite loop.
src/cms-parser.c (ksbacmsparsesigneddatapart2): Finish when detecting no progress. (ksbacmsparseenvelopeddatapart1): Likewise.
--
Found by AISLE in partnership with Red Hat.
Reported by: Jakub Jelen GnuPG-bug-id: 8361 Signed-off-by: NIIBE Yutaka <gniibe () fsij org>
sam