Libgcrypt before version 1.12.2 performs a write to a static array without validating the bounds of the write. Because the data written is not supplied by an attacker, the flaw does not provide a direct remote code execution or information disclosure path. Nonetheless the out‑of‑bounds write can corrupt memory and cause the process to crash, which results in a denial of service for services relying on Libgcrypt for signature generation.

The vulnerability affects the Libgcrypt library that is bundled with GnuPG. Any installation using Libgcrypt older than 1.12.2 is subject to the flaw.

The CVSS score of 4.0 reflects a low‑medium severity assessment, and the EPSS score of less than 1% indicates an extremely low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Because the memory corruption is triggered by static data that is not attacker‑controlled, it is unlikely that an attacker can reliably leverage the out‑of‑bounds write to achieve a purposeful outcome. The risk is therefore limited to potential local crashes, and the attack vector is inferred to be local or confined to the process using the library.