PatchSiren cyber security CVE debrief

CVE-2026-24881 GnuPG CVE debrief

CVE-2026-24881 is a high-severity vulnerability in GnuPG, a popular open-source encryption software. The vulnerability can cause a stack-based buffer overflow, potentially leading to denial of service and remote code execution. GnuPG versions prior to 2.5.17 are affected. The vulnerability was publicly disclosed on January 27, 2026, and has been actively monitored since then. Users and organizations using affected versions should prioritize upgrading to a patched version. Additional information and resources are available through the CVE and NVD websites.

Vendor: GnuPG
Product: Unknown
CVSS: HIGH 8.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-01-27
Original CVE updated: 2026-07-15
Advisory published: 2026-01-27
Advisory updated: 2026-07-15

Who should care

Users and organizations relying on GnuPG for encryption and decryption processes should be aware of this vulnerability. This includes individuals and entities using GnuPG for secure communication, data protection, and compliance with security standards. Given the high severity of the vulnerability, immediate attention is recommended to assess exposure and apply necessary patches or mitigations.

Technical summary

The CVE-2026-24881 vulnerability is caused by a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key. This can trigger a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. The vulnerability has a CVSS score of 8.1 and is classified as HIGH severity. Affected GnuPG versions include those prior to 2.5.17. The vulnerability can be exploited for denial of service and potentially for remote code execution due to memory corruption.

Defensive priority

High. Immediate patching or mitigation is recommended for systems and applications using affected GnuPG versions to prevent potential denial of service and remote code execution.

Recommended defensive actions

Upgrade to GnuPG version 2.5.17 or later.
Review and update GnuPG configurations to ensure secure key handling and decryption processes.
Implement additional monitoring and logging to detect potential exploitation attempts.
Assess and apply compensating controls if immediate patching is not feasible.
Consult official documentation and resources for further guidance on mitigation and remediation.

Evidence notes

The CVE-2026-24881 vulnerability was publicly disclosed on January 27, 2026. The vulnerability affects GnuPG versions prior to 2.5.17. The CVSS score is 8.1, indicating high severity. The vulnerability can be exploited for denial of service and potentially for remote code execution. Additional information is available through the CVE and NVD websites.

Sources and references

Verified primary and authoritative sources

CVE-2026-24881 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-24881

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-24881 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24881

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://dev.gnupg.org/T8044

[email protected] - Exploit, Product
Mitigation or vendor reference
Unverified legacy reference

URL: https://www.openwall.com/lists/oss-security/2026/01/27/8

[email protected] - Mailing List, Third Party Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-24881

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24881.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.