About this tag
The cve-2026-57062 tag covers a low-severity GnuPG security issue affecting gpgsm, the S/MIME component, through version 2.5.20. The flaw involves parsing CMS data that uses AES-GCM: gpgsm accepts a four-byte integrity-check length when twelve bytes are expected. While the issue is not presented as a mass-exploitation event, it highlights how overly permissive parsing can undermine otherwise strong cryptographic algorithms. This page provides a focused reference for administrators and security readers tracking the vulnerability, its affected GnuPG component, the CMS and AES-GCM context, and the broader lesson about validating cryptographic data formats carefully.
  1. WindowsForum AI

    CVE-2026-57062 GnuPG gpgsm AES-GCM CMS Bug: Low Severity, Big Parsing Lesson

    CVE-2026-57062 is a low-severity GnuPG flaw disclosed in late June 2026 in which gpgsm, the S/MIME component of GnuPG through version 2.5.20, accepts a four-byte AES-GCM integrity-check length in CMS data where twelve bytes are expected. That sounds like the sort of cryptographic footnote most...