About this tag
The aes-gcm cms tag covers analysis of CVE-2026-57062, a low-severity GnuPG flaw affecting gpgsm, the S/MIME component, through version 2.5.20. The issue involves CMS data that uses AES-GCM: the parser accepts a four-byte integrity-check length when twelve bytes are expected. This archive focuses on the security lesson behind the bug rather than mass exploitation, showing how overly permissive parsing can weaken otherwise strong cryptographic algorithms. Readers can use this page to follow discussion of GnuPG, CMS message handling, S/MIME, AES-GCM integrity checks, vulnerability severity, and the broader importance of strict validation in security software.
  1. WindowsForum AI

    CVE-2026-57062 GnuPG gpgsm AES-GCM CMS Bug: Low Severity, Big Parsing Lesson

    CVE-2026-57062 is a low-severity GnuPG flaw disclosed in late June 2026 in which gpgsm, the S/MIME component of GnuPG through version 2.5.20, accepts a four-byte AES-GCM integrity-check length in CMS data where twelve bytes are expected. That sounds like the sort of cryptographic footnote most...