{"id":"CVE-2026-118131","kind":"vulnerability","aliases":["CVE-2026-118131"],"related":[],"title":"GnuPG for Windows: default ProgramData permissions let local users plant config","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.","summary":"GnuPG 2.5.21 for Windows inherits a default access control list on C:\\ProgramData that lets any BUILTIN\\Users member create folders there. A low-privilege user can pre-create the GnuPG configuration directory and plant malicious config files that GnuPG components load, running code as the victim user.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","gnupg","package","windows"],"not_affected_if":["gnupg-not-2.5.21","non-windows"],"how_to_check":"- Run `gpg --version` on Windows and check whether it reports `2.5.21`\n- Run `icacls C:\\ProgramData` and look for BUILTIN\\Users rights that allow creating subfolders\n- Check whether a GnuPG configuration directory exists under C:\\ProgramData that ordinary users could have written","fix":"- Move GnuPG to a version newer than `2.5.21` once a fixed release is published (unknown from sources)\n- Remove create-subfolder rights for BUILTIN\\Users on C:\\ProgramData as a workaround (unknown from sources)","status":"open","published_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","triaged_at":"2026-10-27T18:35:10+00:00","updated_at":"2026-10-27T18:35:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T18:35:10Z","model":"claude-haiku-5-5","output":{"fix":"- Move GnuPG to a version newer than `2.5.21` once a fixed release is published (unknown from sources)\n- Remove create-subfolder rights for BUILTIN\\Users on C:\\ProgramData as a workaround (unknown from sources)","reach":"local","title":"GnuPG for Windows: default ProgramData permissions let local users plant config","impact":"high","summary":"GnuPG 2.5.21 for Windows inherits a default access control list on C:\\ProgramData that lets any BUILTIN\\Users member create folders there. A low-privilege user can pre-create the GnuPG configuration directory and plant malicious config files that GnuPG components load, running code as the victim user.","category":"package","nicknames":[],"who_cares":["windows","gnupg","developer-workstations"],"confidence":0.6,"needs_auth":"yes","worst_case":"code runs as the victim user through planted config files","analyst_note":"Confirm the fixed GnuPG version and whether Gpg4win or the upstream build is affected, and check the NVD entry for the vendor advisory.","how_to_check":"- Run `gpg --version` on Windows and check whether it reports `2.5.21`\n- Run `icacls C:\\ProgramData` and look for BUILTIN\\Users rights that allow creating subfolders\n- Check whether a GnuPG configuration directory exists under C:\\ProgramData that ordinary users could have written","needs_analyst":true,"not_affected_if":["non-windows","gnupg-not-2.5.21"],"who_is_affected":"Windows machines with GnuPG 2.5.21 installed where ordinary users share the machine. The flaw needs a local account on the box, so servers with no interactive users and systems that do not use this GnuPG build are lower risk. Teams that only use GnuPG on Linux or macOS can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":3370,"output_tokens":673,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118131':14A,17A '-2026':13A,16A '2.5.21':25B,76C 'access':31B,85C,115C 'allow':95C 'arbitrari':104C 'attack':110C 'builtin':40B,99C 'c':35B,92C 'code':69B,136C 'compon':66B,131C 'config':11A,62B 'configur':57B,121C,126C 'consum':128C 'contain':79C 'context':141C 'control':32B,86C 'creat':43B,54B,103C,117C 'cve':12A,15A 'dacl':88C 'default':4A,30B,83C 'develop':19B 'developer-workst':18B 'directori':58B,94C,122C 'discretionari':84C 'execut':137C 'expect':119C 'file':63B,127C 'folder':44B 'gnupg':1A,21B,24B,56B,65B,74C,120C,130C 'group':101C 'inherit':28B,89C 'inject':124C 'let':7A,38B 'list':33B,87C 'load':67B 'local':8A 'low':48B,113C 'low-privileg':47B,112C 'malici':61B,125C 'member':42B,96C 'packag':22B 'path':108C 'permiss':6A 'plant':10A,60B 'pre':53B 'pre-creat':52B 'privileg':49B,114C 'programdata':5A,36B,93C 'result':134C 'run':68B 'secur':140C 'subdirectori':105C 'user':9A,41B,50B,73B,100C,145C 'version':75C 'victim':72B,144C 'vulner':81C 'window':3A,23B,27B,78C 'within':138C 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with GnuPG 2.5.21 installed where ordinary users share the machine. The flaw needs a local account on the box, so servers with no interactive users and systems that do not use this GnuPG build are lower risk. Teams that only use GnuPG on Linux or macOS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","severity":null,"published_at":"2026-10-27T18:17:36+00:00","modified_at":"2026-10-27T18:17:36+00:00","first_seen_at":"2026-10-27T18:32:59+00:00","fetched_at":"2026-10-27T18:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}