CVE-2003-0978: Format string vulnerability in gpgkeys_hkp (experimental HKP interface) for the GnuPG (gpg) client 1.2.3 an...

Security readout for executives and security teams

This is an old GnuPG client flaw affecting the experimental HKP keyserver retrieval helper. A malicious or compromised keyserver could crash the client during key lookup, and the CVE says arbitrary code execution may be possible. Business urgency depends on whether legacy GnuPG 1.2.3 or 1.3.3-era systems still retrieve keys over HKP. Exposure is most likely on legacy systems running affected GnuPG versions that retrieve keys from HKP keyservers. Modern, supported GnuPG deployments are unlikely to be affected, but the provided sources do not define all downstream package versions or fixed release details. Prioritize this if legacy Linux or build-signing systems still run old GnuPG and contact external keyservers. For modern supported environments, treat it as a legacy hygiene issue and confirm absence rather than launching an emergency response. Mitigation focus: Inventory GnuPG installations and identify versions 1.2.3 or earlier, and 1.3.3 or earlier.; Apply vendor-supported GnuPG updates or distribution advisories for affected systems.; Avoid using untrusted HKP keyservers from legacy affected clients..

Prepared

Jun 30, 2026, 07:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.