CVE-2026-41990: Libgcrypt Buffer Overflow Vulnerability

CVE-2026-41990 Overview

CVE-2026-41990 is an Out-of-Bounds Write vulnerability affecting Libgcrypt before version 1.12.2. The vulnerability exists in the Dilithium signing implementation where writes to a static array lack proper bounds checking. While the vulnerability does not use attacker-controlled data, it can still result in memory corruption leading to integrity and availability impacts.

Critical Impact

Memory corruption in cryptographic library operations could lead to unpredictable behavior, potential denial of service, or integrity issues in systems relying on Libgcrypt for cryptographic operations.

Affected Products

• Libgcrypt versions prior to 1.12.2
• Systems using Dilithium post-quantum cryptographic signing
• Applications and services dependent on Libgcrypt cryptographic functions

Discovery Timeline

• 2026-04-23 - CVE CVE-2026-41990 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41990

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write). The flaw resides in the Dilithium signing implementation within Libgcrypt, which is a post-quantum cryptographic signature scheme. The vulnerable code path involves write operations to a static array without proper bounds validation.

While the vulnerability does not involve attacker-controlled data directly influencing the out-of-bounds write, the missing bounds check creates a condition where memory adjacent to the static array can be corrupted during signing operations. This can manifest as integrity issues where signed data may be improperly processed, or availability issues through potential crashes or undefined behavior.

The local attack vector indicates that exploitation requires local access to the system. The high attack complexity suggests that specific conditions must be met for successful exploitation, limiting the practical exploitability of this vulnerability.

Root Cause

The root cause is a missing bounds check in the Dilithium signing implementation. When performing write operations to a static array during the signing process, the code fails to validate that the write index stays within the allocated array boundaries. This oversight allows memory writes beyond the intended buffer, potentially corrupting adjacent memory regions.

Attack Vector

The attack vector is local, meaning an attacker would need local access to the target system to potentially trigger this vulnerability. Exploitation would involve initiating Dilithium signing operations under specific conditions that cause the bounds check failure.

The vulnerability manifests in the boundary handling of the Dilithium signing algorithm's internal array operations. Detailed technical information about the specific vulnerable code path can be found in the GnuPG Task T8208 and the Openwall OSS Security Discussion.

Detection Methods for CVE-2026-41990

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications utilizing Libgcrypt Dilithium signing functionality
• Memory corruption errors or undefined behavior during cryptographic operations
• Anomalous system behavior when processing post-quantum cryptographic signatures

Detection Strategies

• Inventory all systems and applications using Libgcrypt and verify version numbers against the vulnerable versions (prior to 1.12.2)
• Implement application monitoring for crashes or abnormal terminations in processes using Libgcrypt
• Deploy memory safety monitoring tools to detect out-of-bounds write attempts in cryptographic library operations

Monitoring Recommendations

• Enable verbose logging for applications using Libgcrypt cryptographic functions
• Monitor system stability metrics for processes that perform Dilithium signing operations
• Implement file integrity monitoring on Libgcrypt library files to detect unauthorized modifications

How to Mitigate CVE-2026-41990

Immediate Actions Required

• Upgrade Libgcrypt to version 1.12.2 or later on all affected systems
• Identify all applications and services that depend on Libgcrypt and schedule coordinated updates
• Review and audit systems using Dilithium post-quantum cryptographic signing functionality

Patch Information

The GnuPG project has released Libgcrypt version 1.12.2 which addresses this vulnerability by implementing proper bounds checking in the Dilithium signing implementation. Administrators should obtain the patched version from official GnuPG distribution channels.

For official patch details and release information, refer to the GnuPG Announcement Email.

Workarounds

• If immediate patching is not possible, consider temporarily disabling Dilithium signing functionality if operationally feasible
• Implement additional access controls to limit local access to systems running vulnerable Libgcrypt versions
• Deploy application sandboxing to contain potential memory corruption impacts
• Monitor affected systems closely for signs of abnormal behavior until patches can be applied

# Verify installed Libgcrypt version
libgcrypt-config --version

# Check if system packages need updating (Debian/Ubuntu)
apt-cache policy libgcrypt20

# Update Libgcrypt on Debian/Ubuntu systems
sudo apt update && sudo apt install libgcrypt20

# Check if system packages need updating (RHEL/CentOS/Fedora)
dnf info libgcrypt