CVE-2006-3746

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial...

5.0 MediumPublic exploitFix available

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Exploit likelihood

7.21%Down 8.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: CVE-2006-3746
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: CVE-2006-3746
Updated: 2026-11-02

EUVDEUVD-2006-3740 No score

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: EUVD-2006-3740
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qr6w-8m4j-52r2 No score

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial...

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: GHSA-qr6w-8m4j-52r2
Updated: 2026-11-02

OSVBELL-CVE-2006-3746 5.0

CVE-2006-3746 does not affect BellSoft software

Record: BELL-CVE-2006-3746
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

OSV No score

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: CVE-2006-3746
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-3746 No score

Integer overflow in parse_comment in GnuPG (gpg) 1.4.4 allows remote attackers to cause a denial of service (segmentation fault) via a crafted message.

Record: DEBIAN-CVE-2006-3746
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10815-1 No score

dirmngr-2.2.27-2.4 on GA media

These are all security issues fixed in the dirmngr-2.2.27-2.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10815-1
Updated: 2026-11-02

Affected products

gnupg

Affected packages

Affected packages
Package	Affected	Fixed
`gnupg2` Debian:12	before 1.9.20-2	1.9.20-2
`gnupg2` Debian:13	before 1.9.20-2	1.9.20-2
`gnupg2` Debian:14	before 1.9.20-2	1.9.20-2
`gnupg` Debian:3.1	before 1.4.1-1.sarge5, plus listed versions 1.4.1-11.4.1-1.sarge21.4.1-1.sarge31.4.1-1.sarge41.4.1-1sarge1	1.4.1-1.sarge5
`gnupg2` Debian:3.1	before 1.9.15-6sarge2, plus listed versions 1.9.15-61.9.15-6sarge1	1.9.15-6sarge2
`gnupg` Red Hat:enterprise_linux:3::as	before 0:1.2.1-17	0:1.2.1-17
`gnupg-debuginfo` Red Hat:enterprise_linux:3::as	before 0:1.2.1-17	0:1.2.1-17
`gnupg` Red Hat:enterprise_linux:3::desktop	before 0:1.2.1-17	0:1.2.1-17
`gnupg-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:1.2.1-17	0:1.2.1-17
`gnupg` Red Hat:enterprise_linux:3::es	before 0:1.2.1-17	0:1.2.1-17

Show 12 moreShow less

Affected packages
Package	Affected	Fixed
`gnupg-debuginfo` Red Hat:enterprise_linux:3::es	before 0:1.2.1-17	0:1.2.1-17
`gnupg` Red Hat:enterprise_linux:3::ws	before 0:1.2.1-17	0:1.2.1-17
`gnupg-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:1.2.1-17	0:1.2.1-17
`gnupg` Red Hat:enterprise_linux:4::as	before 0:1.2.6-6	0:1.2.6-6
`gnupg-debuginfo` Red Hat:enterprise_linux:4::as	before 0:1.2.6-6	0:1.2.6-6
`gnupg` Red Hat:enterprise_linux:4::desktop	before 0:1.2.6-6	0:1.2.6-6
`gnupg-debuginfo` Red Hat:enterprise_linux:4::desktop	before 0:1.2.6-6	0:1.2.6-6
`gnupg` Red Hat:enterprise_linux:4::es	before 0:1.2.6-6	0:1.2.6-6
`gnupg-debuginfo` Red Hat:enterprise_linux:4::es	before 0:1.2.6-6	0:1.2.6-6
`gnupg` Red Hat:enterprise_linux:4::ws	before 0:1.2.6-6	0:1.2.6-6
`gnupg-debuginfo` Red Hat:enterprise_linux:4::ws	before 0:1.2.6-6	0:1.2.6-6
`gpg2` openSUSE:Tumbleweed From an advisory covering 8 CVEs	before 2.2.27-2.4	2.2.27-2.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	GnuPG 1.4/1.9 - Parse_Comment Remote Buffer Overflow	2006-07-22

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3746 is a medium vulnerability (CVSS 5.0) in Gnupg, published July 28, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.21%, the 94th percentile. Fixed in gnupg2 1.9.20-2.

References

Show 48 moreShow less