Libgcrypt before version 1.12.2 contains a CWE-787 out-of-bounds write vulnerability related to Dilithium signing. The issue arises because the code writes to a static array without performing bounds checks. However, the data written is not attacker-controlled, which limits the potential impact. The CVSS 3.1 base score is 4.0, reflecting a medium severity with local attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability may cause integrity and availability impacts due to out-of-bounds writes, but since the data is not attacker-controlled, exploitation potential is limited. There are no known exploits in the wild. The local attack vector and high attack complexity further reduce the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor gnupg vendor advisories for updates. No immediate mitigation steps are indicated based on the available information.