CVE-2020-24972: Fedoraproject Fedora

High severity, CVSS 8.8. EPSS: 4.8% chance of exploitation in the next 30 days.

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Affected products

• Fedoraproject Fedora: version 32 only
• Kleopatra Project Kleopatra: before 20.07.80 (fixed in 20.07.80)
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only

Published 2020-08-29. Last modified 2026-06-17.