PT-2026-5010
CVE-2026-24882
·
Published
2026-01-01
·
Updated
2026-10-07
Description by
CVSS 3.1
8.4
HighMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GnuPG versions prior to 2.5.17
Description
GnuPG is a tool for encrypting data and creating digital signatures. A stack-based buffer overflow exists in the
tpm2daemon component when handling the PKDECRYPT command for TPM-backed RSA and ECC keys. This issue could allow for arbitrary code execution. The vulnerability affects systems utilizing TPM-backed RSA/ECC key decryption operations.Recommendations
Upgrade to GnuPG version 2.5.17 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾