The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026

Description and use

In 2025, a researcher uncovered multiple GnuPG vulnerabilities, some fixed but many still unpatched. The 39c3 talk demonstrated signature spoofing and memory corruption, and discussed responsible disclosure and AI’s role in security.

Problem

Vulnerabilities in GnuPG (GPG) were discovered but many remained unpatched, exposing users to spoofed signatures and memory corruption.

Outcome

The talk highlighted persistent security issues in GnuPG, underscored the need for better responsible disclosure, and showcased the state of the codebase.

Workflow

• Discovered initial vulnerability in GPG
• Identified additional independent bugs over months
• Disclosed vulnerabilities weeks before 39c3
• Presented findings at 39c3
• Demonstrated unpatched flaws live
• Discussed responsible disclosure practices and AI impact

Evidence

Some of the bugs ended up getting fixed.

Source

One of the first vulnerabilities I found remains unpatched to this day.

Source