The hex-escape parsing loop in parse_rdn() has a double increment:

for (; hexdigitp (s); s++)
    s++;                      /* <-- BUG: extra increment */

The for-statement increments s at the end of each iteration, AND
the loop body also increments s, so the pointer advances by 2 per
iteration instead of 1. When the hex string has an odd number of
characters, or when the double-stepping causes the pointer to skip
past the null terminator, parse_rdn() reads past the end of the
heap-allocated buffer.

Reported-by: Francisco Tacliad

His full report for this finding is here:

Disclose timeline for this and other findings:

2026-02-11 Initial report to security@gnupg.org
2026-02-12 Response from GnuPG team
2026-02-12 Detailed technical report (this document)