Vulnerability · Published Oct 27, 2026 · Assigned by certcc
CVE-2026-118131CVE-2026-118131
Critical 9.8
In plain English
A critical-severity incorrect permission assignment in GnuPG from GnuPG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | gnupg2 | no fix listed | UBUNTU-CVE-2026-118131 |
| Ubuntu:24.04:LTS | gnupg2 | no fix listed | UBUNTU-CVE-2026-118131 |
| Ubuntu:26.04:LTS | gnupg2 | no fix listed | UBUNTU-CVE-2026-118131 |
| Ubuntu:26.10 | gnupg2 | no fix listed | UBUNTU-CVE-2026-118131 |
Affected products (as reported)
Weakness: CWE-732, CWE-379, CWE-427 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H