CVE-2026-24883
Low · 3.7CVSS
3.7
EPSS
0.5%
Published
Jan 27, 2026
CISA due date
—
The record
In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | gpg2 | 0 | 2.5.5-160000.4.1 |
| openSUSE:Tumbleweed | gpg2 | 0 | 2.5.17-1.1 |
Related vulnerabilities
- CVE-2026-24882 In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during… Also affects gpg2
- CVE-2025-68973 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index… Also affects gpg2
- CVE-2026-24881 In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an… Also affects gpg2
- CVE-2014-4617 The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before… Also affects gpg2
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476