Re: Retrospective by 'gpg.fail' authors
Unreported 0-day RCE in gpgsm 2.4.9 disclosed via gpg.fail talk, triggered by importing a malicious certificate with --debug options.
A retrospective by the gpg.fail authors revealed a remote code execution vulnerability in gpgsm 2.4.9, triggered when invoked as "gpgsm --debug all --import" with a malicious certificate file. The researchers did not report the issue to GnuPG, leaving it unpatched as an apparent 0-day. Exposure appears limited since it requires importing untrusted certificates with debug options enabled.
48