gnupg: AEAD preference list overflow (CVE-2020-25125)
Importing a key with AEAD preferences with GnuPG 2.2 can lead to an array overflow. This is not trivial to exploit because the attacker can control only each second byte with the first byte being fixed at 0x04. But it can be exploited.
Affected versions are GnuPG 2.2.21 and 2.2.22. GnuPG 2.3 and versions before 2.2.21 are not affected.
Fixed In Version: gnupg 2.2.23
References:
Patch:
https://dev.gnupg.org/rGaeb8272ca8aad403a4baac33b8d5673719cfd8f0