CVE-2026-118131
Description
A flaw was found in GnuPG for Windows. Insecure default Discretionary Access Control List (DACL) permissions allow low-privileged local users to create subdirectories under the shared program data directory. A local attacker can exploit this issue by pre-creating the expected configuration directory and planting malicious configuration files. When a victim user executes GnuPG components, these files are loaded, resulting in arbitrary code execution within the security context of the victim user.
Statement
This flaw is rated as having an Important impact because an unprivileged local user could potentially manipulate shared configuration paths to execute arbitrary code within another user's session, bypassing normal security boundaries. However, the vulnerable behavior is specific to Windows environments where default discretionary access control lists allow directory creation under shared system paths. Red Hat Enterprise Linux and container products deploy GnuPG in standard POSIX environments where secure, per-user home directories and strictly controlled system paths prevent this attack vector.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
