A flaw in GnuPG version 2.5.21 for Windows allows a local user who is a member of BUILTIN\Users to create arbitrary subdirectories under C:\ProgramData due to default DACL inheritance. An attacker can construct the expected GnuPG configuration directory and place malicious configuration files that the application automatically consumes, bypassing security checks. This injects and executes arbitrary code within the victim user's security context. The weakness is an improper access control that permits unauthorized configuration injection.

The vulnerability affects the GnuPG software version 2.5.21 running on Windows operating systems where the default permissions on C:\ProgramData allow directory creation by member users. The sole relevant vendor is GnuPG; no other products are listed.

The absence of an assigned CVSS score does not reduce the severity; the issue enables code execution in the victim’s security context, a high‑impact outcome. EPSS is not available, so the exact likelihood of exploitation is unknown, but the vulnerability is active and has not been listed in the CISA KEV catalog. An attacker would only need local user privileges and the ability to write to C:\ProgramData. The configuration files are loaded automatically by GnuPG, so once an attacker writes a malicious file the exploitation chain is complete. The combination of local access and automatic processing makes the risk high for any network or endpoint hosting the impacted GnuPG installation.