CVE-2026-42784

Summary

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:1.10.2.1-1.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 100:1.3.0.2-1.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 90:1.10.2.1-1.el9_8 < *unaffected
Red HatRed Hat Hardened Images0.3.2-4.hum1 < *unaffected

Weaknesses

  • CWE-347: Improper Verification of Cryptographic Signature

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References