CVE-2026-41990

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Apr 23, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-419914.7GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not availableCVE-2026-419927.5GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state betwCVE-2026-419934.4Improper Access Control vulnerability in the Removable Media Validation function of TXOne Networks products allows a local attacker with admCVE-2026-419994.8Incorrect Behaviour of Views with TCP PROXY RequestsCVE-2026-42007.3A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestCVE-2026-420008.6Insufficient Validation of Names During AXFRCVE-2026-420017.5Insufficient Validation of Autoprimary SOA QueriesCVE-2026-420027.5Concurrency and locking defects in GSS-TSIGCVE-2026-420043.7An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT recorCVE-2026-420054.3An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. TheCVE-2026-420064.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking onCVE-2026-420079.1An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing
CVE-2026-41990: Medium severity, CVSS 4.0 | Vulnix