Maniphest T8240

Double free in gpgsm's decrypt function.
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• werner
	Apr 26 2026, 6:29 PM

Tags

Subscribers

Description

Summary of the original bug report:

A crafted CMS/S/MIME message triggers a heap double-free in gpgsm during
normal decryption (gpgsm --decrypt). The crash occurs in the recipient loop
in sm/decrypt.c and is reproducible on the current HEAD as well as on tag
gnupg-2.5.19.

Reported-by: Ciwan Öztopal

Revisions and Commits

rG GnuPG
	rG51aac7a5715d gpgsm: Fix possible double free in the CMS parser.
	rG2ceca1f5f978 gpgsm: Fix possible double free in the CMS parser.
rE libgpg-error
	rEf7ded3ce666c Fix possible stack overflow in es_printf for %.100f format.

Related Objects

Mentioned In: T7997: Release GnuPG 2.5.20
T8239: Release GpgRT 1.61

Event Timeline

• werner renamed this task from Doiuble free in gpgsm's decrypt function. to Double free in gpgsm's decrypt function..Apr 26 2026, 6:29 PM

• werner created this task.

• werner created this object with edit policy "Contributor (Project)".

• werner added projects: gnupg26, Bug Report.

• werner added a commit: rG2ceca1f5f978: gpgsm: Fix possible double free in the CMS parser..Apr 26 2026, 6:32 PM

• werner changed the task status from Open to Testing.Apr 26 2026, 6:40 PM

• werner triaged this task as High priority.

• werner moved this task from Backlog to WIP on the gnupg26 board.

• werner added a project: gnupg22.

• werner added a commit: rG51aac7a5715d: gpgsm: Fix possible double free in the CMS parser..Apr 26 2026, 6:43 PM

• werner moved this task from Backlog to WiP on the gnupg22 board.Apr 26 2026, 6:44 PM

• werner added a commit: rEf7ded3ce666c: Fix possible stack overflow in es_printf for %.100f format..Apr 29 2026, 1:57 PM

• werner mentioned this in T8239: Release GpgRT 1.61.May 7 2026, 10:26 AM

• werner mentioned this in T7997: Release GnuPG 2.5.20.May 13 2026, 3:11 PM

• werner closed this task as Resolved.May 13 2026, 3:14 PM

• werner claimed this task.

• werner moved this task from WIP to Done on the gnupg26 board.

• werner updated the task description. (Show Details)May 18 2026, 10:13 AM

• werner mentioned this in Unknown Object (Maniphest Task).Thu, Aug 27, 11:56 AM