CVE-2026-24881
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution.
Vendor
Product
CWE
Yayın Tarihi
2026-01-27 19:16:16
Güncelleme
2026-02-12 18:15:38
Source Identifier
cve@mitre.org
KEV Date Added
-