kbx/keybox-search.c in GnuPG before 1.4.19 2.0.x before 2.0.27 and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file related to sign extensions and \memcpy with overlapping ranges.\