Resource management error in GnuPG - CVE-2008-1530
Published: August 14, 2025
Vulnerability identifier: #VU114065
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2008-1530
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to improper management of internal resources within the application. A remote attacker can send a specially crafted duplicate keys that are imported from key servers to trigger memory corruption around deduplication of user IDs and execute arbitrary code on the system.
Affected software
GnuPG
How to mitigate CVE-2008-1530
Install updates from vendor's website.
GnuPG - addressed in versions 1.4.9, 2.0.9
External References
- http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html
- http://secunia.com/advisories/29568
- http://www.ocert.org/advisories/ocert-2008-1.html
- http://www.securityfocus.com/bid/28487
- http://www.vupen.com/english/advisories/2008/1056/references
- https://bugs.g10code.com/gnupg/issue894
- https://bugs.gentoo.org/show_bug.cgi?id=214990
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41547