PT-2026-5009 · Gnupg · Gnupg

Openai Security Research · CVE-2026-24881 · Published 2026-01-27 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuPG versions prior to 2.5.17

Description A specially crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can lead to a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can result in denial of service, and potentially memory corruption leading to remote code execution.

Recommendations Update GnuPG to version 2.5.17 or later.

Exploit

Fix

RCE

DoS

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-24881

JLSEC-2026-564

OPENSUSE-SU-2026:10112-1

Affected Products

Gnupg

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24881.json · Exploit
• 🔥 https://dev.gnupg.org/T8044 · Exploit
• https://osv.dev/vulnerability/CVE-2026-24881 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10112-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24881 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-564 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-24883 · Note
• https://twitter.com/CVEnew/status/2016226145616748797 · Twitter Post
• https://t.me/true_secator/7979 · Telegram Post
• https://twitter.com/TheHackerWire/status/2016232014060650968 · Twitter Post
• https://openwall.com/lists/oss-security/2026/01/27/8 · Note
• https://suse.com/security/cve/CVE-2026-24882 · Note
• https://t.me/cveNotify/179558 · Telegram Post
• https://access.redhat.com/security/cve/CVE-2026-24881 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24881.json · Note