Vulnerability-Lookup

ubuntu-cve-2026-24882

Vulnerability from osv_ubuntu

Published

2026-01-27 19:16

Modified

2026-02-09 05:27

Summary

Details

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Severity

8.4 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-24882	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-24882	REPORT
	https://www.openwall.com/lists/oss-security/2026/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dirmngr",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gnupg",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gnupg-agent",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gnupg-l10n",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gnupg-utils",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gnupg2",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpg",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpg-agent",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpg-wks-client",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpg-wks-server",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpgconf",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpgsm",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpgv",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpgv-static",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "gpgv-win32",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "keyboxd",
            "binary_version": "2.4.4-2ubuntu17.4"
          },
          {
            "binary_name": "scdaemon",
            "binary_version": "2.4.4-2ubuntu17.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "gnupg2",
        "purl": "pkg:deb/ubuntu/gnupg2@2.4.4-2ubuntu17.4?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.40-1.1ubuntu1",
        "2.4.4-2ubuntu7",
        "2.4.4-2ubuntu15",
        "2.4.4-2ubuntu16",
        "2.4.4-2ubuntu17",
        "2.4.4-2ubuntu17.2",
        "2.4.4-2ubuntu17.3",
        "2.4.4-2ubuntu17.4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "dirmngr",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gnupg",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gnupg-agent",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gnupg-l10n",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gnupg-utils",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gnupg2",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpg",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpg-agent",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpg-wks-client",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpg-wks-server",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpgconf",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpgsm",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpgv",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "gpgv-static",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "scdaemon",
            "binary_version": "2.4.8-2ubuntu2.1"
          },
          {
            "binary_name": "tpm2daemon",
            "binary_version": "2.4.8-2ubuntu2.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "gnupg2",
        "purl": "pkg:deb/ubuntu/gnupg2@2.4.8-2ubuntu2.1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.4-2ubuntu23",
        "2.4.4-2ubuntu24",
        "2.4.7-17ubuntu3",
        "2.4.8-2ubuntu1",
        "2.4.8-2ubuntu2",
        "2.4.8-2ubuntu2.1"
      ]
    }
  ],
  "aliases": [],
  "details": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.",
  "id": "UBUNTU-CVE-2026-24882",
  "modified": "2026-02-09T05:27:54Z",
  "published": "2026-01-27T19:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-24882"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24882"
    },
    {
      "type": "REPORT",
      "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-24882"
  ],
  "withdrawn": "2026-02-10T05:31:25Z"
}

CVE-2026-24882 (GCVE-0-2026-24882)

Vulnerability from cvelistv5 – Published: 2026-01-27 18:40 – Updated: 2026-07-15 01:16

Summary

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

mitre

References

7 references

URL	Tags
https://www.openwall.com/lists/oss-security/2026/…
https://dev.gnupg.org/T8045
https://access.redhat.com/security/cve/CVE-2026-24882	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2433464	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:2753	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:2719	vendor-advisoryx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
GnuPG	GnuPG	Affected: 0 , < 2.5.17 (semver)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:2.4.5-4.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:2.4.5-2.el10_0.2 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:07:25.362188Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:07:38.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.5-4.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.4.5-2.el10_0.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "gnupg2",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-01-27T18:40:18.166Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in GnuPG. This vulnerability, a stack-based buffer overflow, occurs in the `tpm2daemon` component when processing PKDECRYPT commands for cryptographic keys secured by a Trusted Platform Module (TPM). A local attacker could exploit this to execute unauthorized code, potentially gaining full control of the system, or disrupt its operation, leading to a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-121",
                "description": "Stack-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:16:43.100Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-24882"
          },
          {
            "name": "RHBZ#2433464",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433464"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24882.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2753"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:2719"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:2753: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:2719: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-01-27T19:00:57.683Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-01-27T18:40:18.166Z",
            "value": "Made public."
          }
        ],
        "title": "GnuPG: GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "GnuPG",
          "vendor": "GnuPG",
          "versions": [
            {
              "lessThan": "2.5.17",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnupg:gnupg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T15:45:56.231Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
        },
        {
          "url": "https://dev.gnupg.org/T8045"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-24882",
    "datePublished": "2026-01-27T18:40:18.166Z",
    "dateReserved": "2026-01-27T18:40:17.903Z",
    "dateUpdated": "2026-07-15T01:16:43.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

ubuntu-cve-2026-24882

Vulnerability from osv_ubuntu

CVE-2026-24882 (GCVE-0-2026-24882)

Tags

Sightings

Nomenclature