Arbitrary Subdirectory Creation Vulnerability in GnuPG for Windows

CVE-2026-118131

What is CVE-2026-118131?

A vulnerability exists in GnuPG for Windows that allows members of the BUILTIN\Users group to create subdirectories within the C:\ProgramData directory. This flaw arises from improper default Discretionary Access Control List (DACL) inheritance. A low-privilege attacker can exploit this vulnerability by creating a GnuPG configuration directory in the ProgramData path and placing malicious configuration files within. These files can be consumed by GnuPG components, potentially leading to arbitrary code execution in the context of the affected user.

References