CVE-2026-24882: Gnupg

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Affected products

• Gnupg Gnupg: from 2.5.13, before 2.5.17 (fixed in 2.5.17)
• GPG4WIN GPG4WIN: from 5.0.0, before 5.0.1 (fixed in 5.0.1)

Published 2026-01-27. Last modified 2026-07-15.