CVE-2026-24881
HighCVSS 8.1Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
In GnuPG before version 2.5.17, a crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can lead to denial of service, but also memory corruption that could result in remote code execution.
Risk Assessment
The risk includes potential denial of service and the possibility of remote code execution, which could compromise the confidentiality and integrity of systems using GnuPG for S/MIME message processing.
Recommendation
It is recommended to immediately update GnuPG to version 2.5.17 or later, which includes a fix that eliminates the buffer overflow vulnerability.
Other vulnerabilities in GnuPG
See all- CVE-2019-14855Low
A flaw in GnuPG before version 2.2.18 allows certificate signature forgery using SHA-1 collision attacks. An attacker can create forged certificate signatures, compromising authentication integrity.
- CVE-2026-24882High
In GnuPG before version 2.5.17, a stack-based buffer overflow exists in the tpm2daemon component during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
Original NVD description (English source)
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.