https://seclists.org/oss-sec/2026/q1/124: GnuPG security lease
Published Jan 27, 2026
·Updated
Affected Software
2 affected components
gnupg GnuPG>=2.5.13<2.5.16
Gpg4win Gpg4win>=5.0.0-beta395<5.0.0
Frequently Asked Questions
1
What is the severity of CVE-2026-####?
CVE-2026-#### has been classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2026-####?
To fix CVE-2026-####, upgrade to GnuPG version 2.5.17 or later.
3
What components of GnuPG are affected by CVE-2026-####?
CVE-2026-#### affects the gpg-agent component in GnuPG, specifically during the pkdecrypt process.
4
What types of attacks can exploit CVE-2026-####?
CVE-2026-#### can be exploited through crafted input leading to a stack buffer overflow.
5
Are older versions of GnuPG vulnerable to CVE-2026-####?
Yes, older versions of GnuPG prior to 2.5.17 are vulnerable to CVE-2026-####.