CVE-2008-1530

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-03-27 · updated 2026-06-16
Weakness: CWE-399

Description

GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted duplicate keys that are imported from key servers, which triggers "memory corruption around deduplication of user IDs."

Affected products

GnuPG: 1.4.8, 2.0.8

References

http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html
http://secunia.com/advisories/29568
http://www.ocert.org/advisories/ocert-2008-1.html
http://www.securityfocus.com/bid/28487
http://www.vupen.com/english/advisories/2008/1056/references
https://bugs.g10code.com/gnupg/issue894
https://bugs.gentoo.org/show_bug.cgi?id=214990
https://exchange.xforce.ibmcloud.com/vulnerabilities/41547
http://lists.gnupg.org/pipermail/gnupg-announce/2008q1/000272.html
http://secunia.com/advisories/29568
http://www.ocert.org/advisories/ocert-2008-1.html
http://www.securityfocus.com/bid/28487

Get alerted when CVE-2008-1530 or the next vulnerability affects your stack