CVE-2026-24881: GnuPG gpg-agent Stack-based Buffer Overflow in CMS Decryption
GnuPG from 2.5.13 before 2.5.17 and Gpg4win 5.0.0 before 5.0.1 are affected by a stack-based buffer overflow in gpg-agent. It is triggered by a crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key. The record says the flaw can easily cause denial of service and that the memory corruption could lead to remote code execution, while NVD scores it 9.8 (CVSS 3.1) and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-24881 is a stack-based buffer overflow (CWE-121) in gpg-agent, the GnuPG component that performs private key operations. According to the CVE record, it is triggered by a crafted CMS (S/MIME) EnvelopedData message containing an oversized wrapped session key, during PKDECRYPT--kem=CMS handling.
Impact
The record states that the flaw can easily be leveraged for denial of service. It also states that the memory corruption could lead to remote code execution, which is presented as a possibility and not as a demonstrated outcome. NVD assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the CNA score in the record is 8.1.
Affected products and versions
- GnuPG: from 2.5.13 before 2.5.17.
- Gpg4win: 5.0.0 before 5.0.1.
The fixes field of the record is empty. The upper bounds of the affected ranges indicate the first versions outside the vulnerable range, so administrators should compare installed builds against those boundaries and against vendor advisories.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The GnuPG reference on dev.gnupg.org carries an Exploit tag in the record, but that tag alone does not establish real-world exploitation, and its content was not verified for this analysis.
Remediation and mitigation
- Update GnuPG to version 2.5.17 or later.
- Update Gpg4win to version 5.0.1 or later.
- Check the vendor advisories listed in the references, such as the Red Hat CVE page, for distribution-specific packaging status.
- Until patching is complete, reduce exposure by limiting automated processing of untrusted S/MIME mail and by restricting access to systems where gpg-agent handles messages from external sources.
Detection guidance
- Monitor for unexpected gpg-agent crashes, restarts or core dumps, especially when they coincide with decryption of S/MIME messages.
- Review logs of mail and document processing workflows for repeated decryption failures tied to a single source.
- Keep an inventory of GnuPG and Gpg4win versions so that vulnerable installations can be identified quickly.
Limitations of the available information
The record provides no EPSS score and no SSVC data. The CNA and NVD scores differ, and the fixes field is empty, so fixed builds must be confirmed with vendors. Details on which downstream distributions have backported the fix, and on which mail clients invoke gpg-agent in CMS mode, are unknown.
Frequently asked questions
Is this vulnerability being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
Which versions are affected?
The record lists GnuPG from 2.5.13 before 2.5.17 and Gpg4win 5.0.0 before 5.0.1 as affected.
What should administrators do first?
Compare installed GnuPG and Gpg4win builds with the affected ranges, apply the updates to 2.5.17 or 5.0.1 or later, and check vendor advisories for distribution-specific packages.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.