Search
Search is not available in local development.
Run npx pagefind --site __site after building to enable it.
JLSEC-2026-564 High 8.1

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized...

SourceEditHistoryOSVJSON (OSV)
JLSEC Published
Modified
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Packages
GnuPG_jll >= 2.5.16+0, < 2.5.17+0
Aliases / Upstream
CVE-2026-24881 GHSA-5w36-x85h-pphm EUVD-2026-4768

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT–kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.

References