Gnupg Gnupg vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Gnupg Gnupg: 7 record(s), with affected versions and fixes.cpe:2.3:a:gnupg:gnupg
CVE-2026-105712
Low · 3.6
CWE-61 Oct 5, 2026
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive…
gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.
CVE-2026-57062
Low · 2.9
CWE-1284 Jun 23, 2026
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles…
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
CVE-2026-24883
Medium · 5.5
CWE-476 Jan 27, 2026
NULL Pointer Dereference in Gnupg
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
CVE-2026-24882
High · 7.8
CWE-121 Jan 27, 2026
Stack-based Buffer Overflow in Gnupg
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
CVE-2026-24881
Critical · 9.8
CWE-121 Jan 27, 2026
GnuPG gpg-agent Stack-based Buffer Overflow in CMS Decryption
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.
CVE-2025-68973
High · 7.0
CWE-787 Dec 28, 2025
Out-of-bounds Write in Gnupg
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
CVE-2025-68972
Medium · 4.7
CWE-347 Dec 27, 2025
Improper Verification of Cryptographic Signature in Gnupg
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.