CVE-2026-24882High· 8.4▾ TwilightIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
gnupg >= 2.5.13, < 2.5.17gpg4win >= 5.0.0, < 5.0.1Upgrade past the affected range:
gnupg 2.5.17gpg4win 5.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-24881High· 8.1In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling
CVE-2026-118131NoneCVE-2026-118131
CVE-2025-68973High· 7.8In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input
CVE-2025-68972Medium· 5.9In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified mess…
CVE-2026-105712Low· 3.6gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive
CVE-2026-0719High· 8.6A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication