Re: Retrospective by 'gpg.fail' authors
GnuPG's Werner Koch says gpg.fail samples only crash GnuPG via DER-as-printf format string in --debug x509; RCE claim remains unproven.
Werner Koch replied to the gpg.fail retrospective, noting that GnuPG versions above 2.2 produce garbled stderr or crash when the project's certificates are used with --debug x509 because DER data is passed as a printf format string. Testing the certificates from the researchers' Git repo yielded only a segfault, not demonstrated code execution. Koch states how remote code execution would be achieved is unclear and asks for a real reproducer.
- Format string flaw: DER certificate used as printf format
- Only a segfault reproduced so far; RCE unverified
- Affects --debug x509 path in GnuPG versions > 2.2
From the original article
Posted by Werner Koch on Sep 15 Hi! On Mon, 14 Sep 2026 21:28, Clemens Lang said: Actually in all versions > 2. 2 if you use --debug x509.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.