Cryptographic Vulnerability in sequoia-openpgp

A cryptographic vulnerability (CVE-2026-42784) affects the sequoia-openpgp library, specifically regarding how it handles older OpenPGP certificates. The issue arises when a certificate lacks a key flags subpacket. In these instances, the library incorrectly infers key flags, creating a discrepancy in the assumed capabilities of the certificate. This flaw permits an attacker to bypass the back-signature check, a critical mechanism for verifying the legitimacy of subkey bindings. By exploiting this discrepancy, an attacker can bind arbitrary subkeys to their own certificates and forge signatures that appear valid to systems relying on the affected library. This failure compromises the integrity of cryptographic operations, potentially allowing for unauthorized data access or the impersonation of trusted entities within systems utilizing sequoia-openpgp for certificate validation.

Impact

Successful exploitation compromises cryptographic integrity, allowing for subkey binding forgery and signature spoofing. This affects any application or system leveraging the sequoia-openpgp library for parsing and validating legacy OpenPGP certificates, potentially leading to unauthorized data decryption or identity masquerading.

Recommendation

• Identify all software and services within the infrastructure that utilize the sequoia-openpgp library.
• Monitor vendor security advisories and the official Sequoia PGP release channels for patch availability related to CVE-2026-42784.
• Prioritize updating affected applications to the patched version once released to mitigate the risk of signature forgery.
• Conduct a review of cryptographic validation logic in high-assurance systems to identify dependencies on sequoia-openpgp until the vulnerability is addressed.