CVE-2026-24881

A flaw was found in GnuPG. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. This message, containing an oversized wrapped session key, can cause a stack-based buffer overflow in the gpg-agent component. Successful exploitation may lead to a denial of service and potentially remote code execution.

IMPORTANT: A stack-based buffer overflow in the gpg-agent component of GnuPG can be triggered by a remote attacker sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. This vulnerability could lead to a denial of service and potentially remote code execution on affected Red Hat products where gpg-agent processes such messages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.