8.1
High
CVE-2026-24881 In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause…
Description
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GnuPG 2.5 | 2.5.13 → < 2.5.17 | 2.5.17 |
| Red Hat Enterprise Linux 6 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
Other CVEs of GnuPG
The 9 CVEs of GnuPG →
CVE-2026-118131
CVE-2026-118131
9.8
Critical
CVE-2026-105712
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive
3.6
Low
CVE-2026-57062
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM…
2.9
Low
CVE-2026-24883
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set…
3.7
Low