CVE-2026-57062: CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

lowCVSS 2.9CVE-2026-57062

CSIRTS triage

vendor: null product: GnuPGOtheraffected: through 2.5.20

What: CMS parsing mishandles the CMS format for AES-GCM due to incorrect ICV length acceptance.
Who is affected: Users of GnuPG versions through 2.5.20.
Urgency: Remediation is low priority due to the low severity.
Action: Consider updating GnuPG to a secure version.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GnuPG

Get an email when a new GnuPG advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: low — CVSS 2.9
Published: 2026-06-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57062

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-570620.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-57062	coverage & exploitation status	NVD · CVE.org

Recent advisories for CMS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-11898: The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admi…nvd · 2026-07-11
unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10
unknownCVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists…nvd · 2026-07-10
highGHSA-86vw-x4ww-x467: Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreviewghsa · 2026-07-09
lowGHSA-c43v-4cr8-6mvp: Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file r…ghsa · 2026-07-09
highGHSA-f74w-488g-8x5r: Craft CMS: Potential authenticated Remote Code Execution via referrer redirectghsa · 2026-07-06