Heap-Based Buffer Overflow in Libgcrypt ECDH Decryption Causes DoS

Executive Summary

CVE-2026-41989 is a security vulnerability in Libgcrypt versions before 1.12.2 that sometimes allows a heap-based buffer overflow and denial of service via crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the gcry_pk_decrypt function.

This vulnerability affects ECDH implementations using NIST, Brainpool, X448, or X25519 curves and can cause a buffer overwrite with zeroes during ECDH encryption operations.

The issue was fixed in Libgcrypt versions 1.12.2, 1.11.3, and 1.10.4.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects Libgcrypt versions before 1.12.2, specifically in the ECDH implementation. Detection involves identifying if vulnerable versions of Libgcrypt are installed on your system.

You can check the installed Libgcrypt version using commands like:

• On Linux systems, run: `gcrypt-config --version` or `dpkg -l | grep libgcrypt`
• Alternatively, check the package manager for the installed version, e.g., `rpm -q libgcrypt` on RPM-based systems.

If the version is older than 1.12.2, your system is vulnerable. There are no specific network detection commands provided for this vulnerability since it is a library-level issue triggered by crafted ECDH ciphertext.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to cause a denial-of-service (DoS) condition in applications using vulnerable Libgcrypt versions.

Specifically, the heap-based buffer overflow can be triggered by crafted ECDH ciphertext, leading to application crashes or service interruptions.

Such disruptions can affect the availability of cryptographic services relying on Libgcrypt for ECDH operations.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-41989 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Libgcrypt to version 1.12.2 or later, as this release contains the fix for the buffer overflow and denial-of-service vulnerability in the ECDH implementation.

If you are using GnuPG, ensure you are running version 2.5.7 or later, as these versions use a different encryption API and are not vulnerable.

Verify the integrity and authenticity of the updated packages by checking OpenPGP signatures or SHA-1 checksums using the official GnuPG FTP server or mirrors.

Useful 0 Not Useful 0