goldendivider/gpgsm-cve-2026-57062-cms-gcm-short-tagProof-of-concept demonstrating a CMS AES-GCM short-tag authentication bypass in GnuPG's gpgsm (CVE-2026-57062). Forges a message that decrypts on vulnerable builds but is rejected on patched versions.
GnuPG's gpgsm (the S/MIME and CMS tool) derives the authentication tag
length it verifies from the mac OCTET STRING in a CMS AuthEnvelopedData
(RFC 5083) AES-256-GCM message, and libgcrypt accepts tags as short as 4
bytes. RFC 5084 requires at least 12. Ubuntu fixed this in noble gnupg2
2.4.4-2ubuntu17.6 by rejecting any authtag shorter than 12 octets.
This is a proof of concept: the exact same forged CMS message decrypts on a vulnerable gpgsm and is rejected on a patched one. It does not demonstrate remote compromise. It demonstrates that a message which should fail authentication crosses the gpgsm security gate on the vulnerable build.
Run the same message against both builds and only the GnuPG version changes:
| message | vulnerable gpgsm 2.4.4 | patched gnupg2 2.4.4-2ubuntu17.6 |
|---|
| mac 12 (baseline) | decrypts | decrypts |
| mac 4 (probe) | decrypts (accept) | rejected, non-zero exit |
gpgsm-cve-2026-57062-cms-gcm-short-tag.txt is an Exploitmatic solution
(.txt): data plus asserts, no code. The Exploitmatic runtime (Rust, open
source) does the work at run time:
gpgsm --export, captured whole.cmsgcm transform builds a CMS AuthEnvelopedData
AES-256-GCM message to that certificate with a 12- or 4-byte mac. Only
the public certificate is needed, so it works against any fresh box.gpgsm --decrypt on it, asserting the forged content.A vulnerable gpgsm authenticates the 4-byte-tag message and emits the content. A patched gpgsm refuses and exits non-zero, so nothing reaches stdout and the assert fails.
Precondition: you can already ssh to the box as root with your normal identity (ssh config, agent, or default key). The solution carries no operator credential and no target state.
exploitmatic run gpgsm-cve-2026-57062-cms-gcm-short-tag.txt 127.0.0.1
Point at another box or the patched replica with --var, no file edit:
exploitmatic run gpgsm-cve-2026-57062-cms-gcm-short-tag.txt 127.0.0.1 --var ssh_port=2223
recipient (default USN-8720-Recipient) names the certificate exported
from the target.
| target | result |
|---|---|
| stock gpgsm 2.4.4 (built from source), ssh 2222 | 3/3 verified |
| noble gnupg2 2.4.4-2ubuntu17.6, ssh 2223 | 2/3 not verified (short-tag fails) |
For authorized testing and research only, on systems you own or have permission to test.