Users of the popular PGP Desktop encryption tool are being urged to upgrade to the latest version of the software after the discovery of a flaw in the code.
The flaw exists in the Windows Service which PGP Desktop installs, and could be used by any local or remote user to run code with escalated privileges.
Vulnerability testers NGS Software rated the flaw as a 'medium risk' and said that it affects versions of the software earlier than PGP Desktop 9.5.1.
"The vulnerability occurs because the code responsible for processing the objects passed over the interface to the service does not perform any kind of validation on these objects," said Peter Winter-Smith of NGS Software.
"Instead it trusts that the object data is completely safe in the form that it is received, i.e. absolute pointers are trusted without validation."
The company does not yet have a workaround and is urging all PGP Desktop users to upgrade as a matter of urgency.
Flaw found in PGP Desktop encryption tool
Users urged to upgrade to block intrusion.
Add iTnews as your trusted source
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
.jpg&h=140&w=231&c=1&s=0)
Partner Content
Who owns your brand’s AI reputation?
iTnews State of Security Breakfast comes to Sydney
.jpg&h=140&w=231&c=1&s=0)
Promoted Content
Australian mid-market businesses to access deeper AI and security expertise with First Focus-Integris partnership
Promoted Content
How David Jones, Canva and others are putting agentic AI to work
SPONSORED RESOURCES
Closing the cyber security execution gap: How IT leaders are building cyber resilience
Tech Skills Report
Rethinking Ransomware Recovery: Closing the Detection and Recovery Gap in Asia Pacific
Strategies to Counter the Ransomware Threat in APJ
Craft your ideal hybrid multicloud strategy
Cloud Resilience Summit
iTnews Benchmark Security Awards 2026
iTnews State of Security Breakfast Sydney
iTnews Executive Retreat - Security Leaders Edition - VIC
