---
id: "CVE-2026-118131"
kind: "vulnerability"
aliases: ["CVE-2026-118131"]
title: "GnuPG for Windows: default ProgramData permissions let local users plant config"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developer-workstations", "gnupg", "package", "windows"]
not_affected_if: ["gnupg-not-2.5.21", "non-windows"]
published_at: "2026-10-27T18:17:36+00:00"
first_seen_at: "2026-10-27T18:32:59+00:00"
updated_at: "2026-10-27T18:35:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118131", "first_seen_at": "2026-10-27T18:32:59+00:00"}]
---

# GnuPG for Windows: default ProgramData permissions let local users plant config

GnuPG 2.5.21 for Windows inherits a default access control list on C:\ProgramData that lets any BUILTIN\Users member create folders there. A low-privilege user can pre-create the GnuPG configuration directory and plant malicious config files that GnuPG components load, running code as the victim user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `gpg --version` on Windows and check whether it reports `2.5.21`
- Run `icacls C:\ProgramData` and look for BUILTIN\Users rights that allow creating subfolders
- Check whether a GnuPG configuration directory exists under C:\ProgramData that ordinary users could have written

## Fix

- Move GnuPG to a version newer than `2.5.21` once a fixed release is published (unknown from sources)
- Remove create-subfolder rights for BUILTIN\Users on C:\ProgramData as a workaround (unknown from sources)

## Timeline

- 2026-10-27T18:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118131

## From the sources

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_