Every CVE Search/ Get API key

CVE-2026-24882

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...

8.4 HighFix available

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.44%Up 0.4 points since Jan 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121, CWE-121
Updated
2026-11-02
EUVDEUVD-2026-4769 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
EUVD-2026-4769
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mpc3-hqr8-w5f3 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
GHSA-mpc3-hqr8-w5f3
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
OSVBELL-CVE-2026-24882 7.8
Record
BELL-CVE-2026-24882
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
Show 24 moreShow less
OSVDEBIAN-CVE-2026-24882 7.8

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
DEBIAN-CVE-2026-24882
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-565 7.8

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
JLSEC-2026-565
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1300 8.4

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)

Record
OESA-2026-1300
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1301 8.4

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)

Record
OESA-2026-1301
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1302 8.4

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)

Record
OESA-2026-1302
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1336 8.4

gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.

Security Fix(es):

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)

Record
OESA-2026-1336
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:2719 8.4

Red Hat Security Advisory: gnupg2 security update

Record
RHSA-2026:2719
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:2753 8.4

Red Hat Security Advisory: gnupg2 security update

Record
RHSA-2026:2753
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:2719 8.4

Important: gnupg2 security update

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.

Security Fix(es):

  • GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:2719
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-24882 8.4

CVE-2026-24882 in gnupg2 - Patched by Root

Root has patched CVE-2026-24882 in the gnupg2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-24882 8.4

CVE-2026-24882 in gnupg2 - Patched by Root

Root has patched CVE-2026-24882 in the gnupg2 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-24882 8.4

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
UBUNTU-CVE-2026-24882
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:2719 No score

Important: gnupg2 security update

The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.

Security Fix(es):

  • GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:2719
Updated
2026-11-02
OSVAZL-75266 No score

CVE-2026-24882 affecting package gnupg2 for versions less than 2.4.9-2

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
AZL-75266
Updated
2026-11-05
OSVAZL-76146 No score

CVE-2026-24882 affecting package gnupg2 for versions less than 2.4.0-3

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Record
AZL-76146
Updated
2026-11-02
OSVMGASA-2026-0197 No score

Updated gnupg2 packages fix security vulnerabilities

CVE-2025-68973, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. CVE-2026-24882, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. CVE-2026-24883, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash). Upstream has still not fixed CVE-2025-68972. We will be tracking the solution and providing an update to fix it when possible.

Record
MGASA-2026-0197
Updated
2026-11-02
OSVopenSUSE-SU-2026:10112-1 No score

dirmngr-2.5.17-1.1 on GA media

These are all security issues fixed in the dirmngr-2.5.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10112-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20136-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig->data[] set to a NULL value (bsc#1257395).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
Record
openSUSE-SU-2026:20136-1
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2404-CVE-2026-24882 No score

CVE-2026-24882 in rootio-gnupg2 - Patched by Root

Root has patched CVE-2026-24882 in the rootio-gnupg2 package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2404-CVE-2026-24882
Updated
2026-11-02
OSVSUSE-SU-2026:0434-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

Security fixes:

  • CVE-2026-24882: Fixed stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396)
  • Fixed GnuPG accepting Path Separators and Path Traversals in Literal Data 'Filename' Field (bsc#1256389)
Record
SUSE-SU-2026:0434-1
Updated
2026-11-02
OSVSUSE-SU-2026:20179-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig->data[] set to a NULL value (bsc#1257395).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
Record
SUSE-SU-2026:20179-1
Updated
2026-11-02
OSVSUSE-SU-2026:20195-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig->data[] set to a NULL value (bsc#1257395).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
Record
SUSE-SU-2026:20195-1
Updated
2026-11-02
OSVSUSE-SU-2026:20444-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
Record
SUSE-SU-2026:20444-1
Updated
2026-11-02
OSVSUSE-SU-2026:20487-1 No score

Security update for gpg2

This update for gpg2 fixes the following issues:

  • CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).
  • gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field (bsc#1256389).
Record
SUSE-SU-2026:20487-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnupg2
AlmaLinux:10
 before 2.4.5-4.el10_1
2.4.5-4.el10_1
gnupg2-smime
AlmaLinux:10
 before 2.4.5-4.el10_1
2.4.5-4.el10_1
gnupg2
Azure Linux:3
 before 2.4.9-2
2.4.9-2
gnupg2
Azure Linux:2
 before 2.4.0-3
2.4.0-3
gnupg
Alpaquita:23
 2.2.40-r0 and later None known
gnupg
Alpaquita:25
 2.4.7-r0 and later None known
gnupg
Alpaquita:stream
 2.4.0-r1 and later None known
gnupg2
Debian:13
 All versions, plus listed versions
2.4.7-212.4.7-21+deb13u12.4.8-12.4.8-22.4.8-3
Show 10 moreShow less
2.4.8-42.4.8-52.4.8-62.4.9-12.4.9-22.4.9-32.4.9-42.4.9-52.4.9-62.4.9-7
 None known
gnupg2
Debian:14
 before 2.4.9-4, plus listed versions
2.4.7-212.4.8-12.4.8-22.4.8-32.4.8-4
Show 5 moreShow less
2.4.8-52.4.8-62.4.9-12.4.9-22.4.9-3
2.4.9-4
GnuPG_jll
Julia
 2.5.16+0 up to 2.5.17+0
2.5.17+0
Show 31 moreShow less
Affected packages
PackageAffectedFixed
gnupg2
Mageia:9
From an advisory covering 3 CVEs
 before 2.3.8-1.5.mga9
2.3.8-1.5.mga9
gnupg2
openEuler:24.03-LTS
 before 2.4.3-11.oe2403
2.4.3-11.oe2403
gnupg2
openEuler:24.03-LTS-SP1
 before 2.4.3-14.oe2403sp1
2.4.3-14.oe2403sp1
gnupg2
openEuler:24.03-LTS-SP3
 before 2.4.3-14.oe2403sp3
2.4.3-14.oe2403sp3
gnupg2
openEuler:24.03-LTS-SP2
 before 2.4.3-14.oe2403sp2
2.4.3-14.oe2403sp2
gnupg2-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2-debugsource
Red Hat:enterprise_linux:10.1
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2-smime
Red Hat:enterprise_linux:10.1
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2-smime-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2
Red Hat:enterprise_linux:10.1
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.4.5-2.el10_0.2
0:2.4.5-2.el10_0.2
gnupg2-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:2.4.5-2.el10_0.2
0:2.4.5-2.el10_0.2
gnupg2-smime
Red Hat:enterprise_linux_eus:10.0
 before 0:2.4.5-2.el10_0.2
0:2.4.5-2.el10_0.2
gnupg2-smime-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:2.4.5-2.el10_0.2
0:2.4.5-2.el10_0.2
gnupg2
Red Hat:enterprise_linux_eus:10.0
 before 0:2.4.5-2.el10_0.2
0:2.4.5-2.el10_0.2
gnupg2
Rocky Linux:10
 before 0:2.4.5-4.el10_1
0:2.4.5-4.el10_1
gnupg2
Root:Debian:12
 before 2.2.40-1.1+deb12u2.root.io.5
2.2.40-1.1+deb12u2.root.io.52.2.40-1.1+deb12u2.aikido.62.2.40-1.1+deb12u2.aikido.7
rootio-gnupg2
Root:Debian:12
 before 2.2.40-1.1+deb12u2.root.io.5
2.2.40-1.1+deb12u2.root.io.52.2.40-1.1+deb12u2.aikido.62.2.40-1.1+deb12u2.aikido.7
gnupg2
Root:Debian:13
 before 2.4.7-21+deb13u1.aikido.5
2.4.7-21+deb13u1.aikido.52.4.7-21+deb13u1.root.io.42.4.7-21+deb13u1.aikido.62.4.7-21+deb13u1.aikido.72.4.7-21+deb13u1.aikido.82.4.7-21+deb13u1.aikido.92.4.7-21+deb13u1.aikido.102.4.7-21+deb13u1.aikido.11
rootio-gnupg2
Root:Debian:13
 before 2.4.7-21+deb13u1.aikido.5
2.4.7-21+deb13u1.aikido.52.4.7-21+deb13u1.root.io.42.4.7-21+deb13u1.aikido.62.4.7-21+deb13u1.aikido.72.4.7-21+deb13u1.aikido.82.4.7-21+deb13u1.aikido.92.4.7-21+deb13u1.aikido.102.4.7-21+deb13u1.aikido.11
gpg2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.4.4-150600.3.15.1
2.4.4-150600.3.15.1
gpg2
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 2.4.4-150600.3.15.1
2.4.4-150600.3.15.1
gpg2
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 2.4.4-150600.3.15.1
2.4.4-150600.3.15.1
gpg2
openSUSE:Leap 15.6
 before 2.4.4-150600.3.15.1
2.4.4-150600.3.15.1
gpg2
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 2.5.5-160000.4.1
2.5.5-160000.4.1
gpg2
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 2.5.5-160000.4.1
2.5.5-160000.4.1
gpg2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 2.5.5-160000.4.1
2.5.5-160000.4.1
gpg2
SUSE:Linux Micro 6.0
 before 2.4.4-7.1
2.4.4-7.1
gpg2
SUSE:Linux Micro 6.1
 before 2.4.4-slfo.1.1_7.1
2.4.4-slfo.1.1_7.1
gpg2
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.5.17-1.1
2.5.17-1.1
gpg2
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.5.5-160000.4.1
2.5.5-160000.4.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-24882 is a high vulnerability (CVSS 8.4) in Gnupg, published January 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in gnupg2 2.4.5-4.el10_1.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open