CVE-2026-118131 in GnuPG
Summary
by MITRE • 10/27/2026
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in GnuPG version 2.5.21 for Windows stems from a misconfiguration in the default Discretionary Access Control List (DACL) inheritance applied to the C:\ProgramData directory. This system-level folder is intended to store application data accessible by all users on the local machine, but its security permissions are often overly permissive regarding subdirectory creation. Specifically, members of the BUILTIN\Users group retain write and create file rights that extend into child directories unless explicitly restricted. In this scenario, GnuPG relies on specific paths within ProgramData for storing configuration files and keyrings without implementing sufficient access controls to prevent unauthorized modification or creation of these structures by standard user accounts. This oversight creates a classic path traversal and privilege escalation vector where the trust boundary between system-level application data and user-writable space is blurred, allowing any authenticated local user to manipulate the environment in which GnuPG operates.
From an operational perspective, this flaw enables an attacker with low-privilege access to perform a directory injection attack. By creating arbitrary subdirectories under C:\ProgramData that mimic expected GnuPG configuration paths, the attacker can place maliciously crafted configuration files into these locations. When a victim user subsequently launches GnuPG or any component thereof, the application reads its configuration from these injected files rather than secure defaults. Because GnuPG processes these configurations with the privileges of the invoking user, and potentially interacts with system resources based on those settings, an attacker can engineer specific inputs that trigger unintended behavior. This could range from redirecting key storage to malicious locations to exploiting parsing vulnerabilities within the configuration loader itself, ultimately leading to arbitrary code execution in the context of the victim user. The impact is severe as it bypasses standard sandboxing expectations and allows a low-privileged account to compromise the integrity and confidentiality of cryptographic operations performed by that user.
This vulnerability aligns with CWE-276, which describes incorrect default permissions for mandatory security features, specifically where defaults are too permissive. It also maps closely to ATT&CK technique T1548.003, Abuse Elevation Control Mechanism, through the sub-technique of Misconfigured Default Permissions. The attack vector leverages local privilege escalation principles by exploiting the system's trust in default directory structures. To mitigate this risk, administrators should audit and restrict DACLs on C:\ProgramData to prevent non-administrative users from creating new directories or modifying existing configuration files outside their own user-specific profiles. Implementing strict inheritance rules that deny write access for subdirectory creation at the ProgramData level is critical. Additionally, GnuPG developers should enforce stricter validation of configuration file locations and avoid relying solely on default system paths without verifying ownership and permissions before processing them. Regular security audits using tools like Sysinternals AccessChk can help identify such misconfigurations across enterprise environments to prevent exploitation by malicious insiders or compromised low-privilege accounts.