Vulnerability Description
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
References
FAQ
What is CVE-2026-118131?
CVE-2026-118131 is a documented vulnerability. GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group...
How severe is CVE-2026-118131?
CVSS scoring is not yet available for CVE-2026-118131. Check NVD for updates.
Is there a patch for CVE-2026-118131?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.