Not scored
CVE-2026-24881
GnuPG vulnerability
Status
- Not in CISA KEV
- Fixed in version 2.5.17
Exploit probabilityEPSSchecked 25 Oct
1.8%probability of exploitation in the next 30 days
Higher than 79% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.
Coverage 1 article · 1 outlet
- OpenAI Codex Security flags CVEs in OpenSSH and GnuTLS in betaThe Hacker News · first in our coverage