CVE-2026-24881 GnuPG CVE debrief

Who should care

Users and organizations relying on GnuPG for encryption and decryption processes should be aware of this vulnerability. This includes individuals and entities using GnuPG for secure communication, data protection, and compliance with security standards. Given the high severity of the vulnerability, immediate attention is recommended to assess exposure and apply necessary patches or mitigations.

Technical summary

The CVE-2026-24881 vulnerability is caused by a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key. This can trigger a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. The vulnerability has a CVSS score of 8.1 and is classified as HIGH severity. Affected GnuPG versions include those prior to 2.5.17. The vulnerability can be exploited for denial of service and potentially for remote code execution due to memory corruption.

Defensive priority

High. Immediate patching or mitigation is recommended for systems and applications using affected GnuPG versions to prevent potential denial of service and remote code execution.

Recommended defensive actions

• Upgrade to GnuPG version 2.5.17 or later.
• Review and update GnuPG configurations to ensure secure key handling and decryption processes.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Assess and apply compensating controls if immediate patching is not feasible.
• Consult official documentation and resources for further guidance on mitigation and remediation.

Evidence notes

The CVE-2026-24881 vulnerability was publicly disclosed on January 27, 2026. The vulnerability affects GnuPG versions prior to 2.5.17. The CVSS score is 8.1, indicating high severity. The vulnerability can be exploited for denial of service and potentially for remote code execution. Additional information is available through the CVE and NVD websites.

Official resources