Threat database

CVE-2026-41990 is a medium-severity vulnerability in Libgcrypt versions before 1.12.2. It involves an out-of-bounds write related to Dilithium signing where writes to a static array lack proper bounds checking. However, the data written is not attacker-controlled, which limits the potential impact. There is no known exploit in the wild, and no official patch or remediation level has been confirmed yet.

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.