Libgcrypt before version 1.12.2 contains a CWE-787 out-of-bounds write vulnerability in its handling of Dilithium signing. The issue arises because writes to a static array do not include bounds checking. Despite this, the vulnerability does not involve attacker-controlled data, which reduces the risk of exploitation. The CVSS 3.1 base score is 4.0, reflecting a medium severity with local attack vector, high attack complexity, no privileges required, and no user interaction needed. No official patch or vendor advisory has been provided to confirm remediation status.

The vulnerability can cause integrity and availability impacts due to out-of-bounds writes, but since the data written is not attacker-controlled, the risk of arbitrary code execution or data corruption caused by an attacker is limited. No known exploits exist in the wild, and the attack requires local access with high complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider upgrading to Libgcrypt 1.12.2 or later once available. No other specific mitigations are indicated by the vendor or advisory.