CVE-2026-24881Disclosure(gnupg / gnupg)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch gnupg gnupg systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

gnupg CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://dev.gnupg.org/T8044

Vendor / third-party advisories

https://www.openwall.com/lists/oss-security/2026/01/27/8

Other references

Weakness type (CWE)

CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gnupg
gpg4win

Threat summary

Patch or workaround signal is available
6 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 4d ago at 2 mentions (2026-01-27); latest day: 1
6 total mentions across 5 days

Affected systems

Vendors

gnupg gpg4win

Products

gnupggpg4win

Deep dive

Activity timeline6 mentions / 5d

Signal classification3 categories

Disclosure

350.0%

General

233.3%

Patch

116.7%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-27	2	Disclosure2
2026-01-28	1	General1
2026-02-08	1	Patch1
2026-03-09	1	Disclosure1
2026-05-02	1	General1

Full discourse6 posts

Open Source Security mailing list@oss_security245d
Patch
GnuPG 2.5.17 fixes possible RCE & more https://www.openwall.com/lists/oss-security/2026/01/27/8 CVE-2026-24881 T8044 gpg-agent stack buffer overflow in pkdecrypt using KEM, affects only GnuPG and Gpg4win released 2025-10-22+ CVE-2026-24882 T8045 Stack-based buffer overflow in TPM2 PKDECRYPT CVE-2026-24883 T8049
Post summary
The advisory announces that GnuPG 2.5.17 includes a patch for multiple CVEs, notably RCE and stack buffer overflows, and provides a link to the vendor's security mailing list.
0321041.3K
4.4K followersView on X
~lyn@lynettdoteth162d
General
@tiredhungryangr One? CVE-2026-2796, CVE-2026-24881, CVE-2026-24882, CVE-2025-32988, CVE-2025-32989, CVE-2025-64175, CVE-2026-25242, CVE-2026-28357, CVE-2026-28359, CVE-2026-26216, CVE-2026-26217, CVE-2026-25946, CVE-2026-32110, CVE-2026-30930, CVE-2026-30928, CVE-2026-32596...
Post summary
The tweet simply lists multiple CVE identifiers without offering additional context or technical information.
10000932
825 followersView on X
Kazuki Omo@omokazuki256d
General
SIOSセキュリティブログを更新しました。 GnuPGの脆弱性(High: CVE-2026-24881, CVE-2026-24882, Low: CVE-2026-24883) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #linux #gnupg #gpg https://security.sios.jp/vulnerability/gnupg-security-vulnerability-20260129/
Post summary
The post announces three GnuPG CVEs with severity designations but provides no further technical, exploit, or mitigation details.
00010117
360 followersView on X
Machina Record@MachinaRecord216d
Disclosure
⚠️OpenAIのCodex Security、コミット120万件から深刻度の高いセキュリティ上の問題を10,561件発見（CVE-2026-24881、CVE-2026-24882他） 🇺🇸米州法でOS年齢確認義務化の動きが広がる〜サイバーセキュリティ週末の話題〜 https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/44451/
Post summary
OpenAI’s Codex Security discovered 10,561 high‑severity security issues across 1.2 million commits, including CVE‑2026‑24881 and CVE‑2026‑24882; no proof‑of‑concept, exploit, or patch information is provided.
00000197
1.2K followersView on X
The Hacker Wire@TheHackerWire257d
Disclosure
🟠 CVE-2026-24881 - High In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS h... https://www.thehackerwire.com/vulnerability/CVE-2026-24881/ https://t.co/HQKIgw4LFw
Post summary
A stack‑based buffer overflow vulnerability (CVE‑2026‑24881) in GnuPG <2.5.17 is disclosed, triggered by crafted CMS EnvelopedData messages containing oversized wrapped session keys; no PoC, patch, or exploitation evidence is provided.
0000051
113 followersView on X
CVE@CVEnew257d
Disclosure
CVE-2026-24881 In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent du… https://www.cve.org/CVERecord?id=CVE-2026-24881
Post summary
The post discloses a stack-based buffer overflow in GnuPG's gpg-agent caused by oversized wrapped session keys in CMS (S/MIME) EnvelopedData messages.
00000172
56.5K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gnupg	gnupg	-	-	-
App	gpg4win	gpg4win	-	-	-

Explore more

Back to dashboard gnupg CVEs gpg4win CVEs gnupg vulnerabilities

What researchers are saying

CVE-2026-24881

~lyn[verified]@lynettdotethGeneral

The tweet simply lists multiple CVE identifiers without offering additional context or technical information.

Machina Record[verified]@MachinaRecordDisclosure

OpenAI’s Codex Security discovered 10,561 high‑severity security issues across 1.2 million commits, including CVE‑2026‑24881 and CVE‑2026‑24882; no proof‑of‑concept, exploit, or patch information is provided.

Open Source Security mailing list@oss_securityPatch

The advisory announces that GnuPG 2.5.17 includes a patch for multiple CVEs, notably RCE and stack buffer overflows, and provides a link to the vendor's security mailing list.

Kazuki Omo@omokazukiGeneral

The post announces three GnuPG CVEs with severity designations but provides no further technical, exploit, or mitigation details.

The Hacker Wire@TheHackerWireDisclosure

A stack‑based buffer overflow vulnerability (CVE‑2026‑24881) in GnuPG <2.5.17 is disclosed, triggered by crafted CMS EnvelopedData messages containing oversized wrapped session keys; no PoC, patch, or exploitation evidence is provided.

CVE@CVEnewDisclosure

The post discloses a stack-based buffer overflow in GnuPG's gpg-agent caused by oversized wrapped session keys in CMS (S/MIME) EnvelopedData messages.