CVE-2026-57062: GnuPG gpgsm CMS AES-GCM Authentication Tag Validation Bypass

Technical summary

CVE-2026-57062 concerns a validation bypass in gpgsm's CMS parser when processing AES-GCM-encrypted messages. The authenticated encryption tag length (aes-ICVlen) is specified in RFC standards as 12 bytes for security, but the affected versions through 2.5.20 accept a 4-byte tag without validation. This reduces the effective authentication strength and could theoretically enable an attacker to craft or modify ciphertexts that pass integrity checks. The flaw is categorized under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating the parser does not correctly enforce cryptographic parameter constraints. The issue is related to CVE-2026-34182, suggesting a broader pattern in CMS handling.

Business impact

The practical business risk is low because successful exploitation requires local access and the attacker must be able to intercept or substitute CMS-formatted messages in transit or at rest. Organizations relying on gpgsm for email encryption, document signing, or secure inter-system communication should evaluate whether they handle untrusted CMS messages from external sources. If gpgsm is used only for internal, trusted communications or as one layer in a defense-in-depth approach, the direct risk is minimal. However, any organization that depends on CMS integrity validation for compliance (e.g., HIPAA, PCI-DSS) should address this to maintain a strict security posture.

Affected systems

GnuPG versions through 2.5.20 are affected. The vulnerability is specific to the gpgsm component, which is the CMS/S.MIME handler within GnuPG. Systems using gpgsm to parse or verify CMS-formatted cryptographic messages are at risk. This includes Linux distributions, BSD systems, and other platforms where GnuPG is deployed. End-user systems running older versions of GnuPG, as well as server infrastructure using gpgsm for automated message processing, should be assessed.

Exploitability

Exploitation is constrained by three factors: (1) the attack vector is local (AV:L), meaning the attacker must have some level of access to the affected system; (2) the attack complexity is high (AC:H), requiring specific conditions or prerequisites; and (3) the integrity impact is limited (I:L), affecting only message integrity, not confidentiality or availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no known active exploitation in the wild as of the last update. The low CVSS score (2.9) reflects these constraints. An attacker would need to forge a malformed CMS message and have it processed by the vulnerable gpgsm, which might succeed only in specific configurations.

Remediation

The primary remediation is to upgrade GnuPG to a version beyond 2.5.20 that includes the fix for this validation issue. Verify the exact patched version by consulting the official GnuPG release notes and security advisories. In the interim, organizations can reduce exposure by: (1) restricting access to systems running gpgsm, minimizing the local attack surface; (2) implementing strict controls on which external CMS messages are processed; (3) layering additional integrity checks on top of CMS validation; and (4) monitoring for unexpected changes in signed or encrypted message handling.

Patch guidance

Check the GnuPG project website and your Linux distribution's security advisories for release information on versions after 2.5.20. Most major distributions (Debian, Ubuntu, Red Hat, etc.) will provide patched packages through their standard repositories. Verify that the specific patch addresses aes-ICVlen validation in CMS parsing. If you maintain GnuPG from source, build and test the latest stable release and perform regression testing on any automated systems that depend on CMS message verification before deploying to production.

Detection guidance

Detection of exploitation attempts is challenging because the flaw allows acceptance of invalid cryptographic parameters rather than crashing or raising errors. Log any unusual CMS message validation failures or rejections in gpgsm output. Monitor for CMS-formatted messages with unexpected structures, though this requires parsing and inspection at the application level. Consider enabling verbose logging in gpgsm (if supported by your version) to capture details of processed messages. Audit which external sources feed CMS messages into your systems and validate the authenticity of those sources independently.

Why prioritize this

Despite a low CVSS score, this vulnerability warrants attention in environments where CMS message integrity is a security boundary. The flaw is not actively exploited (not on KEV), but it represents a cryptographic validation bypass that could enable message tampering. Prioritize patching in systems that process CMS messages from untrusted or semi-trusted sources. For organizations using GnuPG only for internal, controlled communications, this can be addressed in a regular patching cycle rather than as an emergency.

Risk score, explained

The CVSS 3.1 score of 2.9 (LOW) reflects limited exploitability: local attack vector, high complexity, and low integrity impact with no effect on confidentiality or availability. The score appropriately penalizes a flaw that requires system access and specific conditions. However, the context matters—the underlying issue is a cryptographic validation bypass, which is conceptually serious. The low score reflects the practical constraints of the attack, not the severity of the underlying weakness. Organizations should not dismiss this purely on CVSS grounds if CMS integrity is critical to their threat model.

Frequently asked questions