CVE-2026-41989 is a vulnerability in libgcrypt where the gcry_pk_decrypt function improperly calculates buffer sizes when processing crafted ECDH ciphertext, leading to a heap-based buffer overflow. This can cause a denial of service condition by crashing the application. The vulnerability is identified as CWE-131 (Incorrect Calculation of Buffer Size) and CWE-787 (Out-of-bounds Write). Red Hat has analyzed this issue affecting their Hardened Images and Enterprise Linux 9 and 10 variants but currently does not provide an official patch or mitigation that meets their criteria for ease of use, applicability, or stability.

The vulnerability allows remote attackers to cause a denial of service by sending specially crafted ECDH ciphertext to the vulnerable function. This results in a heap-based buffer overflow that crashes the application or service using libgcrypt. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild. The severity is rated medium by Red Hat.

Red Hat currently does not offer an official fix or mitigation that meets their deployment and stability criteria. Users are advised to monitor Red Hat advisories for updates. No workaround or mitigation is currently available. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Upgrading to a future fixed version when available is recommended.