CVE-2026-24881

Published: 1/27/2026 Last updated: 1/27/2026 Reserved: 1/27/2026

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

CNA assigner: mitre (8254265b-2729-46b6-b9e3-3dfca2d5bfca) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	8.1	High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Opam packages affected (1)

0install

Products affected (1)

Product	Vendor	Version
GnuPG	GnuPG	CLI 2.0.1

References (2)

https://www.openwall.com/lists/oss-security/2026/01/27/8
https://dev.gnupg.org/T8044