CVE-2005-0366: The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (C...

Security readout for executives and security teams

CVE-2005-0366 is a cryptographic weakness in OpenPGP integrity checking for CFB-encrypted messages. Under specific conditions, an attacker may recover part of a protected message. The issue is serious for organizations relying on affected OpenPGP software for sensitive email or file protection, but the source bundle does not show active exploitation or a complete affected-product list. Exposure is most likely where legacy OpenPGP implementations process attacker-supplied encrypted messages and reveal distinguishable integrity-check failure behavior. The bundle names OpenPGP broadly but does not identify specific affected products or versions in the structured affected field. Handle as a targeted legacy cryptography exposure. It is not evidenced as an active mass-exploitation emergency, but organizations depending on OpenPGP for confidential communications should verify affected software and update unsupported components. Mitigation focus: Check current vendor advisories for affected OpenPGP implementations and supported fixes.; Upgrade or replace unsupported OpenPGP software handling sensitive encrypted messages.; Avoid exposing detailed integrity-check failure differences to untrusted senders or callers..

Prepared

Jun 30, 2026, 00:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.