CVE-2026-57062
Publication date 23 June 2026
Last updated 4 September 2026
Ubuntu priority
Description
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
Read the notes from the security team
Why is this CVE low priority?
This is a low severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gnupg2 | 26.04 LTS resolute |
Fixed 2.4.8-4ubuntu3.1
|
| 25.10 questing | Ignored end of life, was needs-triage | |
| 24.04 LTS noble |
Fixed 2.4.4-2ubuntu17.6
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Notes
Severity score breakdown
CVSS version: CVSS v3.0
Base score 2.9 · Low
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8720-1
- GnuPG vulnerability
- 3 September 2026