Junglewise Threat Intelligence

CVE-2026-24882: GnuPG stack overflow in tpm2daemon PKDECRYPT handling

CVE-2026-24882 · Severity: high · CVSS 8.4 · Published 2026-01-27

Technologies: GnuPG. Vendors: GnuPG.

Executive brief

GnuPG is a widely used tool for encrypting data and managing digital signatures. A security flaw in its TPM (Trusted Platform Module) helper component allows a local attacker to cause a system crash or potentially take control of the software. This could lead to the exposure of sensitive cryptographic keys or unauthorized access to encrypted data on systems using TPM-backed security.

Technical details

A stack-based buffer overflow exists in GnuPG's tpm2daemon component within the cmd_pkdecrypt function. The vulnerability is caused by a lack of length validation when copying attacker-supplied ciphertext into fixed-size TPM work buffers (tpm2_rsa_decrypt and tpm2_ecc_decrypt). A local attacker with access to the daemon's Assuan socket can send an oversized ciphertext payload (up to 4096 bytes) to trigger the overflow. This occurs before PIN prompts or TPM operations, potentially allowing for arbitrary code execution with the privileges of the tpm2daemon process. The issue is fixed in GnuPG 2.5.17 and Gpg4win 5.0.1.

Affected products

  • GnuPG GnuPG 2.5.13 to 2.5.16
  • Gpg4win Gpg4win 5.0.0

Timeline

  • 2025-12-30: other: Vulnerable version 2.5.16 released
  • 2026-01-18: disclosed: Vulnerability reported to vendor by OpenAI Security Research
  • 2026-01-27: patched: GnuPG 2.5.17 released with fix
  • 2026-01-27: advisory: Public disclosure and CVE assignment

References

Related threats