VDB
CVE-2026-41990
CVE-2026-41990
PUBLISHED
CVSS 4 MEDIUM
Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.
EPSS 0.18% · 7.3th percentile
Risk Scores
CVSS 3.1
4
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS Score
0.18%
7.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| gnupg | Libgcrypt | 1.12.0 |
| gnupg | libgcrypt | 1.12.0 |
Timeline
- Apr 23, 2026 EPSS Score
- Apr 23, 2026 CVE Published
- Apr 23, 2026 Security Advisory
- Apr 23, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score