All packages
GnuPG vulnerabilities
3 known CVE vulnerabilities in GnuPG, translated and rated.
- CVE-2019-14855Low
A flaw in GnuPG before version 2.2.18 allows certificate signature forgery using SHA-1 collision attacks. An attacker can create forged certificate signatures, compromising authentication integrity.
- CVE-2026-24882High
In GnuPG before version 2.5.17, a stack-based buffer overflow exists in the tpm2daemon component during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
- CVE-2026-24881High
In GnuPG before version 2.5.17, a crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can lead to denial of service, but also memory corruption that could result in remote code execution.