GnuPG gpgsm passes attacker-controlled Subject Key Identifier bytes from an X.509 certificate directly as a printf format string in gpgsm_check_cert_sig (sm/certcheck.c), allowing out-of-bounds reads and %n-based memory writes that can lead to remote code execution when a crafted certificate is verified. The vulnerable call is reached only when X.509 debugging is enabled (DBG_X509). Introduced in GnuPG 2.3.0 by commit b1694987bb6484405d41d34046a5290176feadd0; corrected by commit 160fa97c10d7229e2ced978dc168fdcb5bf6a00b, which replaces the log_debug call with log_printhex.