Stack-Based Buffer Overflow in GnuPG Product by GnuPG
CVE-2026-24882

8.4HIGH

Key Information:

Vendor

Gnupg

Status
Gnupg
Vendor
CVE Published:
27 January 2026

What is CVE-2026-24882?

A stack-based buffer overflow vulnerability exists in the GnuPG software prior to version 2.5.17. This issue occurs in the tpm2daemon component during the processing of the PKDECRYPT command for RSA and ECC keys supported by the Trusted Platform Module (TPM). If successfully exploited, this vulnerability could lead to unauthorized access or manipulation of cryptographic keys, posing risks to system integrity and data security. Users of GnuPG are advised to update to the latest version to mitigate potential exploitation.

Affected Version(s)

GnuPG 0 < 2.5.17

References

https://www.openwall.com/lists/oss-security/2026/01/27/8
https://dev.gnupg.org/T8045

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.