CVE-2010-3618: Pgp Desktop For Mac

Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days.

PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue.

Affected products

• Pgp Desktop For Mac: up to and including 10.0.3; version 10.0.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.1.0 only
• Pgp Desktop For Windows: up to and including 10.0.3; version 10.0.0 only; version 10.0.1 only; version 10.0.2 only; version 10.0.3 only; version 10.1.0 only

Published 2010-11-22. Last modified 2026-06-16.