CVE-2026-24881

Summary

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT–kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

Affected Software

Weaknesses

• CWE-121: CWE-121 Stack-based Buffer Overflow

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

GnuPG: GnuPG: Remote code execution and denial of service via crafted CMS EnvelopedData message

Additional References

• https://access.redhat.com/security/cve/CVE-2026-24881
• https://bugzilla.redhat.com/show_bug.cgi?id=2433480
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24881.json

References

• https://www.openwall.com/lists/oss-security/2026/01/27/8
• https://dev.gnupg.org/T8044

• ←Previous
• Next→