{"id":"CVE-2026-24882","aliases":["ALSA-2026:2719","AZL-75266","AZL-76146","BELL-CVE-2026-24882","DEBIAN-CVE-2026-24882","EUVD-2026-4769","GHSA-mpc3-hqr8-w5f3","JLSEC-2026-565","MGASA-2026-0197","OESA-2026-1300","OESA-2026-1301","OESA-2026-1302","OESA-2026-1336","RHSA-2026:2719","RHSA-2026:2753","RLSA-2026:2719","ROOT-OS-DEBIAN-12-CVE-2026-24882","ROOT-OS-DEBIAN-13-CVE-2026-24882","ROOT-OS-UBUNTU-2404-CVE-2026-24882","SUSE-SU-2026:0434-1","SUSE-SU-2026:20179-1","SUSE-SU-2026:20195-1","SUSE-SU-2026:20444-1","SUSE-SU-2026:20487-1","UBUNTU-CVE-2026-24882","openSUSE-SU-2026:10112-1","openSUSE-SU-2026:20136-1"],"status":"published","title":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00438,"percentile":0.3847,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2026-01-27T18:40:18Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"gnupg2","fixed_in":["2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"gnupg2-smime","fixed_in":["2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"gnupg2","fixed_in":["2.4.9-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"gnupg2","fixed_in":["2.4.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnupg2","fixed_in":["2.4.9-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"GnuPG_jll","fixed_in":["2.5.17+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"gnupg2","fixed_in":["2.4.3-11.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","fixed_in":["2.4.3-14.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","fixed_in":["2.4.3-14.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"gnupg2","fixed_in":["2.4.3-14.oe2403sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-debuginfo","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-debugsource","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-smime","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-smime-debuginfo","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-debuginfo","fixed_in":["0:2.4.5-2.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-debugsource","fixed_in":["0:2.4.5-2.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-smime","fixed_in":["0:2.4.5-2.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-smime-debuginfo","fixed_in":["0:2.4.5-2.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2","fixed_in":["0:2.4.5-2.el10_0.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"gnupg2","fixed_in":["0:2.4.5-4.el10_1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"gnupg2","fixed_in":["2.2.40-1.1+deb12u2.root.io.5","2.2.40-1.1+deb12u2.aikido.6","2.2.40-1.1+deb12u2.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-gnupg2","fixed_in":["2.2.40-1.1+deb12u2.root.io.5","2.2.40-1.1+deb12u2.aikido.6","2.2.40-1.1+deb12u2.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"gnupg2","fixed_in":["2.4.7-21+deb13u1.aikido.5","2.4.7-21+deb13u1.root.io.4","2.4.7-21+deb13u1.aikido.6","2.4.7-21+deb13u1.aikido.7","2.4.7-21+deb13u1.aikido.8","2.4.7-21+deb13u1.aikido.9","2.4.7-21+deb13u1.aikido.10","2.4.7-21+deb13u1.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-gnupg2","fixed_in":["2.4.7-21+deb13u1.aikido.5","2.4.7-21+deb13u1.root.io.4","2.4.7-21+deb13u1.aikido.6","2.4.7-21+deb13u1.aikido.7","2.4.7-21+deb13u1.aikido.8","2.4.7-21+deb13u1.aikido.9","2.4.7-21+deb13u1.aikido.10","2.4.7-21+deb13u1.aikido.11"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","fixed_in":["2.4.4-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gpg2","fixed_in":["2.4.4-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gpg2","fixed_in":["2.4.4-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"gpg2","fixed_in":["2.4.4-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","fixed_in":["2.4.4-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","fixed_in":["2.4.4-slfo.1.1_7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.40-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"gnupg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-21","2.4.7-21+deb13u1","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3","2.4.9-4","2.4.9-5","2.4.9-6","2.4.9-7"]},{"source":"osv","ecosystem":"Debian:14","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-4"}]}],"versions":["2.4.7-21","2.4.8-1","2.4.8-2","2.4.8-3","2.4.8-4","2.4.8-5","2.4.8-6","2.4.9-1","2.4.9-2","2.4.9-3"]},{"source":"osv","ecosystem":"Julia","package":"GnuPG_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.16+0"},{"fixed":"2.5.17+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-1.5.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-11.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-14.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-14.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-14.oe2403sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2-smime-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-2.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-2.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-smime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-2.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2-smime-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-2.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-2.el10_0.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-4.el10_1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.40-1.1+deb12u2.root.io.5"},{"fixed":"2.2.40-1.1+deb12u2.aikido.6"},{"fixed":"2.2.40-1.1+deb12u2.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.40-1.1+deb12u2.root.io.5"},{"fixed":"2.2.40-1.1+deb12u2.aikido.6"},{"fixed":"2.2.40-1.1+deb12u2.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-21+deb13u1.aikido.5"},{"fixed":"2.4.7-21+deb13u1.root.io.4"},{"fixed":"2.4.7-21+deb13u1.aikido.6"},{"fixed":"2.4.7-21+deb13u1.aikido.7"},{"fixed":"2.4.7-21+deb13u1.aikido.8"},{"fixed":"2.4.7-21+deb13u1.aikido.9"},{"fixed":"2.4.7-21+deb13u1.aikido.10"},{"fixed":"2.4.7-21+deb13u1.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-gnupg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-21+deb13u1.aikido.5"},{"fixed":"2.4.7-21+deb13u1.root.io.4"},{"fixed":"2.4.7-21+deb13u1.aikido.6"},{"fixed":"2.4.7-21+deb13u1.aikido.7"},{"fixed":"2.4.7-21+deb13u1.aikido.8"},{"fixed":"2.4.7-21+deb13u1.aikido.9"},{"fixed":"2.4.7-21+deb13u1.aikido.10"},{"fixed":"2.4.7-21+deb13u1.aikido.11"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-slfo.1.1_7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.17-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gpg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-160000.4.1"}]}],"bundled":2}],"products":[{"vendor":"gnupg","product":"gnupg"},{"vendor":"gpg4win","product":"gpg4win"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/8","tags":["Mailing List","Third Party Advisory","web","article","report"]},{"url":"https://dev.gnupg.org/T8045","tags":["Exploit","Product","web","article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24882","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433464","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2753","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2719","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24882","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-mpc3-hqr8-w5f3","tags":["web"]},{"url":"https://bugzilla.redhat.com/2433464","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-2719.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-24882","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24882.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-24882","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0197.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34934","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/12/28/1","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7946-1","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/27/11","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1300","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1301","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1302","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1336","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2719.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24882","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2753.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:2719","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260434-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256389","tags":["report"]},{"url":"https://bugzilla.suse.com/1257396","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24882","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620179-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257395","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24883","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620195-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620444-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620487-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-24882","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24881","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T18:40:18.166Z","modified":"2026-07-15T01:16:43.1Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121","CWE-121"],"updated_at":"2026-11-02T14:19:50.92611Z"}],"euvd":[{"id":"EUVD-2026-4769","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T18:40:18Z","modified":"2026-07-15T01:16:43Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-mpc3-hqr8-w5f3","title":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T21:31:49Z","modified":"2026-06-30T03:36:31Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T19:16:16.67Z","modified":"2026-07-15T02:18:52.297Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"BELL-CVE-2026-24882","status":"published","published":"2026-01-29T06:07:46.50908Z","modified":"2026-02-08T07:16:56.011225Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T18:40:18.166Z","modified":"2026-10-28T02:30:51.901808303Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:44:59.438965Z"},{"id":"DEBIAN-CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T19:16:16.67Z","modified":"2026-10-01T03:03:09.278409771Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-565","title":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-05-27T18:18:39.624Z","modified":"2026-07-18T00:00:52.456130939Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1300","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.763473524Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1301","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.939062622Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1302","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)","status":"published","published":"2026-02-06T11:10:19Z","modified":"2026-08-18T01:19:31.738665332Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1336","title":"gnupg2 security update","description":"GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP).  GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories.\r\n\r\nSecurity Fix(es):\n\nIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.(CVE-2026-24882)","status":"published","published":"2026-02-13T11:10:21Z","modified":"2026-08-18T01:19:32.705157926Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"RHSA-2026:2719","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2026-02-17T10:12:25Z","modified":"2026-07-19T10:17:02Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:2753","title":"Red Hat Security Advisory: gnupg2 security update","status":"published","published":"2026-02-17T10:12:32Z","modified":"2026-07-19T10:17:05Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2026:2719","title":"Important: gnupg2 security update","description":"The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.\n\nSecurity Fix(es):\n\n* GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-24T18:56:34.668877Z","modified":"2026-02-24T19:15:43.528095Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-24882","title":"CVE-2026-24882 in gnupg2 - Patched by Root","description":"Root has patched CVE-2026-24882 in the gnupg2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-07T14:38:14Z","modified":"2026-10-07T15:15:21.622549355Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-24882","title":"CVE-2026-24882 in gnupg2 - Patched by Root","description":"Root has patched CVE-2026-24882 in the gnupg2 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-10-06T08:47:31Z","modified":"2026-10-06T09:15:03.048393218Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-24882","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"withdrawn","published":"2026-01-27T19:16:00Z","modified":"2026-02-10T08:14:11.664395Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:2719","title":"Important: gnupg2 security update","description":"The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards.  \n\nSecurity Fix(es):  \n\n  * GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution (CVE-2026-24882)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-16T00:00:00Z","modified":"2026-10-29T11:58:12.797092Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"AZL-75266","title":"CVE-2026-24882 affecting package gnupg2 for versions less than 2.4.9-2","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T19:16:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.456773Z"},{"id":"AZL-76146","title":"CVE-2026-24882 affecting package gnupg2 for versions less than 2.4.0-3","description":"In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.","status":"published","published":"2026-01-27T19:16:16Z","modified":"2026-04-21T04:39:01.555243Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"MGASA-2026-0197","title":"Updated gnupg2 packages fix security vulnerabilities","description":"CVE-2025-68973, armor_filter in g10/armor.c has two increments of an\nindex variable where one is intended, leading to an out-of-bounds write\nfor crafted input.\nCVE-2026-24882, a stack-based buffer overflow exists in tpm2daemon\nduring handling of the PKDECRYPT command for TPM-backed RSA and ECC\nkeys.\nCVE-2026-24883, a long signature packet length causes parse_signature to\nreturn success with sig-\u003edata[] set to a NULL value, leading to a denial\nof service (application crash).\nUpstream has still not fixed CVE-2025-68972. We will be tracking the solution\nand providing an update to fix it when possible. \n","status":"published","published":"2026-06-11T16:55:52Z","modified":"2026-06-11T17:00:04.885717604Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10112-1","title":"dirmngr-2.5.17-1.1 on GA media","description":"These are all security issues fixed in the dirmngr-2.5.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-29T00:00:00Z","modified":"2026-03-23T04:54:28.086103Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20136-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).\n- CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig-\u003edata[] set to a NULL value (bsc#1257395).\n- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field (bsc#1256389).\n","status":"published","published":"2026-01-29T16:14:38Z","modified":"2026-03-23T04:54:45.514338Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"ROOT-OS-UBUNTU-2404-CVE-2026-24882","title":"CVE-2026-24882 in rootio-gnupg2 - Patched by Root","description":"Root has patched CVE-2026-24882 in the rootio-gnupg2 package for Root:Ubuntu:24.04. Multiple fixed versions available.","status":"withdrawn","published":"2026-02-02T09:19:11Z","modified":"2026-03-25T19:08:28.126878Z","updated_at":"2026-11-02T15:53:38.68316Z"},{"id":"SUSE-SU-2026:0434-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2026-24882: Fixed stack-based buffer overflow in TPM2 \n  PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396)\n- Fixed GnuPG accepting Path Separators and Path Traversals in Literal \n  Data 'Filename' Field (bsc#1256389)\n","status":"published","published":"2026-02-11T09:23:20Z","modified":"2026-03-23T04:52:14.16307Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20179-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).\n- CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig-\u003edata[] set to a NULL value (bsc#1257395).\n- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field (bsc#1256389).\n","status":"published","published":"2026-01-29T16:09:32Z","modified":"2026-03-23T04:52:41.451883Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20195-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).\n- CVE-2026-24883: denial of service due to long signature packet length causing parse_signature to return success with sig-\u003edata[] set to a NULL value (bsc#1257395).\n- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field (bsc#1256389).\n","status":"published","published":"2026-01-29T16:09:32Z","modified":"2026-03-23T04:52:42.440758Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20444-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).\n- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field (bsc#1256389).\n","status":"published","published":"2026-02-16T14:21:49Z","modified":"2026-03-23T04:52:55.831983Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20487-1","title":"Security update for gpg2","description":"This update for gpg2 fixes the following issues:\n\n- CVE-2026-24882: stack-based buffer overflow in TPM2 PKDECRYPT for TPM-backed RSA and ECC keys (bsc#1257396).\n- gpg.fail/filename: GnuPG Accepts Path Separators and Path Traversals in Literal Data \"Filename\" Field (bsc#1256389).\n","status":"published","published":"2026-02-17T09:38:47Z","modified":"2026-03-23T04:52:59.700944Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}