{"id":"CVE-2026-118131","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-118131","generatedAt":"2026-10-28T03:26:02.536Z","title":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path.","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.","published":"2026-10-27T18:17:37.000Z","lastModified":"2026-10-27T18:17:37.000Z","status":"Received","sourceIdentifier":"cret@cert.org","cvss":null,"cwe":[],"affected":[],"epss":null,"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-27T18:17:37.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-27T18:17:36.700Z"},"summary":"New CVE, not yet scored."}],"references":[{"url":"https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing","source":"cret@cert.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}