Gpg4win Gpg4win vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Gpg4win Gpg4win: 3 record(s), with affected versions and fixes.
cpe:2.3:a:gpg4win:gpg4win

CVE-2026-24883 Medium · 5.5 CWE-476 Jan 27, 2026

NULL Pointer Dereference in Gnupg

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).

CVE-2026-24882 High · 7.8 CWE-121 Jan 27, 2026

Stack-based Buffer Overflow in Gnupg

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

CVE-2026-24881 Critical · 9.8 CWE-121 Jan 27, 2026

GnuPG gpg-agent Stack-based Buffer Overflow in CMS Decryption

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.