CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

🗓️ 27 Jun 2026 08:05:11Reported by MicrosoftType

GnuPG gpgsm CMS parsing accepts four-byte AES-GCM ICV instead of twelve.

Reporter	Title	Published	Views	Family All 172
FreeBSD	OpenSSL -- Multiple vulnerabilities	9 Jun 202600:00	–	freebsd
FreeBSD	FreeBSD -- Multiple vulnerabilities in OpenSSL	9 Jun 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple critical vulnerabilities in OpenSSL, Java SE, and Jetty	11 Aug 202609:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in OpenSSL	14 Jul 202622:25	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	6 Jul 202615:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impact AIX due to OpenSSL	22 Jul 202608:36	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSL affects IBM Netezza Appliance	11 Aug 202607:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	8 Jul 202606:43	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of OpenSSL, IBM EntireX is vulnerable to multiple vulnerabilities	1 Jul 202622:38	–	ibm
ATTACKERKB	CVE-2026-57062	23 Jun 202617:26	–	attackerkb