Libgcrypt versions prior to 1.12.2 contain a heap-based buffer overflow vulnerability triggered by specially crafted ECDH ciphertext passed to the gcry_pk_decrypt function. This vulnerability is classified as CWE-787 (Out-of-bounds Write) and can cause denial of service and integrity violations. The CVSS 3.1 score is 6.7, reflecting a medium severity with local attack vector, high attack complexity, no privileges required, no user interaction, and impacts on integrity and availability. The vulnerability affects multiple versions including 1.8.8, 1.11.0, and 1.12.0. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation can result in heap-based buffer overflow leading to denial of service and potential integrity compromise of the affected system. Confidentiality is not impacted. The attack requires local access with high complexity and no privileges or user interaction, limiting the ease of exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted ECDH ciphertext with vulnerable versions of Libgcrypt. Monitor vendor channels for updates and apply patches promptly once available.