GnuPG vulnerabilities

CVEs per yearBy the year they were published

1. 20181
2. 20253
3. 20268

Newest CVEs

• CVE-2026-118131

  CVE-2026-118131

  GnuPG · GnuPG

  Critical9.8
• CVE-2026-105712

  gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an…

  GnuPG · GnuPG

  Low3.6
• CVE-2026-57062

  CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes…

  GnuPG · GnuPG

  Low2.9
• CVE-2026-41990

  Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.

  gnupg · Libgcrypt

  Medium4.0
• CVE-2026-41989

  Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

  gnupg · Libgcrypt

  Medium6.7
• CVE-2026-24883

  In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of…

  GnuPG · GnuPG

  Low3.7
• CVE-2026-24882

  In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

  GnuPG · GnuPG

  High8.4
• CVE-2026-24881

  In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in…

  GnuPG · GnuPG

  High8.1
• CVE-2025-68973

  In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted…

  GnuPG · GnuPG

  High7.8
• CVE-2025-68972

  In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text…

  GnuPG · GnuPG

  Medium5.9