CVE-2026-24882: GnuPG Buffer Overflow Vulnerability

CVE-2026-24882 Overview

A stack-based buffer overflow vulnerability has been discovered in GnuPG before version 2.5.17. The vulnerability exists within the tpm2daemon component during the handling of the PKDECRYPT command when processing TPM-backed RSA and ECC keys. This flaw could allow an attacker with local access to execute arbitrary code or cause a denial of service by corrupting stack memory.

Critical Impact

Local attackers can exploit this stack-based buffer overflow to potentially execute arbitrary code with the privileges of the tpm2daemon process, compromising the integrity of cryptographic operations and sensitive key material.

Affected Products

• GnuPG versions prior to 2.5.17
• Systems utilizing tpm2daemon for TPM-backed RSA key operations
• Systems utilizing tpm2daemon for TPM-backed ECC key operations

Discovery Timeline

• 2026-01-27 - CVE-2026-24882 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24882

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a critical memory corruption vulnerability that occurs when a program writes more data to a stack buffer than it was designed to hold. In the context of GnuPG's tpm2daemon, this overflow occurs during the processing of PKDECRYPT commands specifically when handling TPM-backed RSA and ECC keys.

The tpm2daemon acts as an intermediary between GnuPG and Trusted Platform Module (TPM) hardware, managing cryptographic operations for keys protected by the TPM. The PKDECRYPT command is responsible for decrypting data using private keys stored in the TPM. Due to insufficient bounds checking on input data during this operation, an attacker can craft malicious input that exceeds the allocated stack buffer, potentially overwriting critical stack data including return addresses.

Because this vulnerability requires local access, exploitation typically occurs in scenarios where an attacker already has some level of system access and seeks to escalate privileges or compromise cryptographic operations.

Root Cause

The root cause of this vulnerability lies in improper input validation within the PKDECRYPT command handler in tpm2daemon. When processing decryption requests for TPM-backed RSA and ECC keys, the code fails to properly verify the size of incoming data against the fixed-size stack buffer allocated for processing. This allows oversized input to overflow the buffer boundaries, corrupting adjacent stack memory.

Stack-based buffer overflows are particularly dangerous because the stack contains return addresses and saved frame pointers that control program execution flow. By carefully crafting the overflow data, an attacker could potentially redirect execution to malicious code.

Attack Vector

The attack vector for CVE-2026-24882 is local, meaning an attacker must have some form of local access to the target system to exploit this vulnerability. The attack could be executed by:

1. Sending specially crafted PKDECRYPT requests to the tpm2daemon process
2. Providing maliciously oversized key data during decryption operations
3. Exploiting the buffer overflow to overwrite stack return addresses
4. Redirecting execution flow to attacker-controlled code or causing a crash

The vulnerability does not require user interaction and can be exploited without prior authentication to the tpm2daemon service, though local system access is required.

The vulnerability manifests in the PKDECRYPT command handling routine within tpm2daemon. When processing decryption requests for TPM-backed keys, insufficient bounds checking allows oversized input to overflow stack buffers. For detailed technical information, refer to the GnuPG Task T8045 security advisory.

Detection Methods for CVE-2026-24882

Indicators of Compromise

• Unexpected crashes or segmentation faults in the tpm2daemon process
• Abnormal memory access patterns or stack corruption errors in system logs
• Unusual PKDECRYPT command activity with oversized payloads
• Process execution anomalies following tpm2daemon operations

Detection Strategies

• Monitor system logs for tpm2daemon crashes, segmentation faults, or abnormal terminations
• Implement process monitoring to detect unexpected child processes spawned from tpm2daemon
• Use memory protection tools like Address Sanitizer (ASan) in development environments to detect buffer overflows
• Deploy endpoint detection solutions capable of identifying stack-based exploitation attempts

Monitoring Recommendations

• Enable verbose logging for GnuPG and tpm2daemon operations to capture detailed transaction data
• Monitor for unusual patterns in TPM-related system calls using auditd or similar tools
• Implement file integrity monitoring on GnuPG binaries to detect unauthorized modifications
• Configure alerts for repeated tpm2daemon process restarts which may indicate exploitation attempts

How to Mitigate CVE-2026-24882

Immediate Actions Required

• Upgrade GnuPG to version 2.5.17 or later immediately
• If immediate patching is not possible, consider disabling tpm2daemon if TPM-backed keys are not essential
• Review system access controls to limit which users and processes can interact with tpm2daemon
• Monitor for exploitation attempts using the detection strategies outlined above

Patch Information

The GnuPG project has addressed this vulnerability in version 2.5.17. Organizations should upgrade to this version or later to remediate the stack-based buffer overflow in tpm2daemon. For detailed patch information and discussion, refer to:

• GnuPG Task T8045 - Official GnuPG bug tracker entry
• Openwall OSS Security Discussion - Security disclosure discussion

Workarounds

• Disable tpm2daemon service if TPM-backed key operations are not required for your environment
• Restrict local access to trusted users only, reducing the attack surface for local exploitation
• Implement mandatory access control (MAC) policies using SELinux or AppArmor to confine tpm2daemon capabilities
• Consider using alternative cryptographic key storage mechanisms until patching is complete

# Configuration example - Disable tpm2daemon if not required
# Check if tpm2daemon is running
systemctl status tpm2daemon

# Stop and disable tpm2daemon service
sudo systemctl stop tpm2daemon
sudo systemctl disable tpm2daemon

# Verify GnuPG version after upgrade
gpg --version | head -n 1
# Expected output: gpg (GnuPG) 2.5.17 or higher