A crafted ECDH ciphertext can cause Libgcrypt to overflow a heap buffer during decryption, which may crash the process and deny service. The vulnerability is rooted in improper handling of ciphertext size and memory allocation, as reflected by the CWE identifiers for buffer over‑read and overflow.

The flaw exists in all releases of Libgcrypt older than 1.12.2. Any system that incorporates Libgcrypt before that version—such as GnuPG and other cryptographic applications—may be affected unless the library has been upgraded or patched.

The CVSS score of 6.7 indicates a medium severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood of widespread attacks. However, the attack vector is inferred to require delivery of a crafted ciphertext to the library, meaning that any application or service that feeds external data into gcry_pk_decrypt is potentially at risk.