As per upstream report: Importing a key with AEAD preferences with GnuPG 2.2 can lead to an array overflow. This is not trivial to exploit because the attacker can control only each second byte with the first byte being fixed at 0x04. But it can be exploited. Affected versions are GnuPG 2.2.21 and 2.2.22. GnuPG 2.3 and versions before 2.2.21 are not affected.
External References: https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html https://dev.gnupg.org/T5050 https://bugzilla.opensuse.org/show_bug.cgi?id=1176034
Upstream patch: https://dev.gnupg.org/rGaeb8272ca8aad403a4baac33b8d5673719cfd8f0
Acknowledgments: Name: the GnuPG project