CVE-2026-24883: Gnupg

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).

Affected products

• Gnupg Gnupg: from 2.5.13, before 2.5.17 (fixed in 2.5.17)
• GPG4WIN GPG4WIN: from 5.0.0, before 5.0.1 (fixed in 5.0.1)

Published 2026-01-27. Last modified 2026-06-17.