PT-2026-5009 · Gnupg · Gnupg

Openai Security Research · Published 2026-01-27 · Updated 2026-03-10 · CVE-2026-24881

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuPG versions prior to 2.5.17

Description A specially crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can lead to a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can result in denial of service, and potentially memory corruption leading to remote code execution.

Recommendations Update GnuPG to version 2.5.17 or later.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-24881

OPENSUSE-SU-2026:10112-1

Affected Products

Gnupg

References · 12

• 🔥 https://dev.gnupg.org/T8044 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24881 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10112-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24881 · Vendor Advisory
• https://t.me/true_secator/7979 · Telegram Post
• https://twitter.com/oss_security/status/2020359875256275020 · Twitter Post
• https://suse.com/security/cve/CVE-2026-24881 · Note
• https://twitter.com/CVEnew/status/2016226145616748797 · Twitter Post
• https://suse.com/security/cve/CVE-2026-24883 · Note
• https://twitter.com/TheHackerWire/status/2016232014060650968 · Twitter Post
• https://suse.com/security/cve/CVE-2026-24882 · Note
• https://openwall.com/lists/oss-security/2026/01/27/8 · Note