SecBoard
Zurück zur CVE-Übersicht

CVE-2026-118131

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceFileEvents
| where FolderPath startswith "C:\ProgramData\" and InitiatingProcessFolderPath contains "gpg.exe"
| where ActionType == "FileCreated" and FileName endswith ".conf"
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=WinEventLog:Security) EventCode=11 Image="*gpg.exe" TargetFilename="C:\ProgramData\*.conf" | table _time, Host, Image, TargetFilename, CommandLine

Sigma

title: GnuPG Malicious Config File Creation
status: experimental
description: Detects creation of configuration files in GnuPG's ProgramData directory by non-privileged users, which could indicate an attempt to inject malicious configurations.
logsource:
  category: file_event
  product: windows
detection:
  selection:
    EventID: 11 # Sysmon Event ID for FileCreate
    TargetFilename|startswith: 'C:\ProgramData\'
    TargetFilename|endswith: '.conf'
    Image|endswith: '\gpg.exe'
  condition: selection
fields:
  - Image
  - TargetFilename
  - User
level: high

Elastic ES|QL

file where file.path : "C:\\ProgramData\\*.conf" and process.executable : "*\\gpg.exe" and event.action : "file_create"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen