The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Affected: Ubuntu:Pro:14.04:LTS: libcrypto++, Ubuntu:Pro:16.04:LTS: libcrypto++, Ubuntu:18.04:LTS: libcrypto++, Ubuntu:20.04:LTS: libcrypto++, Ubuntu:22.04:LTS: libcrypto++, Ubuntu:24.04:LTS: libcrypto++, Ubuntu:25.10: libcrypto++, Ubuntu:26.04:LTS: libcrypto++

The ElGamal implementation in Crypto++ through 8.5 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.