Live › vulnerability › CVE-2026-118131
Go to dashboardGnuPG 2.5.21 for Windows inherits a default access control list on C:\ProgramData that lets any BUILTIN\Users member create folders there. A low-privilege user can pre-create the GnuPG configuration directory and plant malicious config files that GnuPG components load, running code as the victim user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.
Windows machines with GnuPG 2.5.21 installed where ordinary users share the machine. The flaw needs a local account on the box, so servers with no interactive users and systems that do not use this GnuPG build are lower risk. Teams that only use GnuPG on Linux or macOS can skip it.
No product ranges from the sources yet.
gpg --version on Windows and check whether it reports 2.5.21icacls C:\ProgramData and look for BUILTIN\Users rights that allow creating subfolders2.5.21 once a fixed release is published (unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
This page as .md · .json · in your agent: get_signal("CVE-2026-118131")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.