CVE-2026-24883: GnuPG Denial of Service Vulnerability

CVE-2026-24883 Overview

A denial of service vulnerability exists in GnuPG before version 2.5.17 that can be triggered through specially crafted signature packets. When processing a signature packet with an excessively long length value, the parse_signature function incorrectly returns success while leaving sig->data[] set to a NULL value. Subsequent operations that attempt to access this NULL pointer result in an application crash, causing a denial of service condition.

Critical Impact

Attackers can crash GnuPG applications by sending malformed signature packets with long length fields, disrupting cryptographic operations and potentially affecting systems that rely on GnuPG for signature verification.

Affected Products

• GnuPG versions prior to 2.5.17

Discovery Timeline

• 2026-01-27 - CVE-2026-24883 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24883

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference). The flaw resides in GnuPG's signature packet parsing logic, specifically within the parse_signature function. When an attacker provides a signature packet with an abnormally long length value, the function fails to properly handle this boundary condition. Instead of returning an error, the function returns a success status while the signature data array (sig->data[]) remains initialized to NULL.

The vulnerability can be exploited remotely over a network connection, though exploitation requires specific conditions to be met, making it relatively difficult to exploit in practice. The impact is limited to availability—causing the application to crash—without compromising data confidentiality or integrity.

Root Cause

The root cause lies in improper input validation within the parse_signature function. When parsing OpenPGP signature packets, the function does not adequately validate the packet length field before attempting to allocate and populate the signature data structure. An excessively long length value causes the allocation or parsing logic to fail silently, leaving the sig->data[] array in a NULL state while still returning a success indicator to the calling code.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a malformed OpenPGP signature packet to a vulnerable GnuPG instance. This could occur in several scenarios:

• Processing a malicious email signature via email clients that integrate with GnuPG
• Verifying a crafted signed document or file
• Importing a malicious key or signature from a keyserver
• Any application that processes untrusted OpenPGP data through GnuPG

The vulnerability manifests in the signature packet parsing routine where boundary validation is insufficient. When a packet declares an excessively long signature length, the parser fails to properly reject the malformed input, resulting in a NULL pointer that causes a crash when dereferenced during subsequent signature verification operations. For detailed technical information, see the GnuPG Task T8049 and the OpenWall OSS-Security Discussion.

Detection Methods for CVE-2026-24883

Indicators of Compromise

• Unexpected GnuPG process crashes or core dumps during signature verification operations
• Application logs showing segmentation faults or NULL pointer access errors in GnuPG-related processes
• Repeated failures when processing specific signed messages or documents

Detection Strategies

• Monitor for GnuPG process crashes and analyze crash dumps for NULL pointer dereference patterns in signature parsing code paths
• Implement network-level inspection for OpenPGP packets with anomalous or excessively long signature length fields
• Deploy application-level logging to track signature verification failures and correlate with potential exploitation attempts

Monitoring Recommendations

• Enable crash reporting and monitoring for all systems running GnuPG or applications that depend on GnuPG for cryptographic operations
• Set up alerts for unusual patterns of signature verification failures that may indicate exploitation attempts
• Monitor keyserver interactions and email processing systems for delivery of malformed signature packets

How to Mitigate CVE-2026-24883

Immediate Actions Required

• Upgrade GnuPG to version 2.5.17 or later immediately on all affected systems
• Review and audit any systems that process untrusted OpenPGP data for exposure to this vulnerability
• Consider implementing input validation at the application layer to reject abnormally large signature packets before passing to GnuPG

Patch Information

The vulnerability has been addressed in GnuPG version 2.5.17. Users should upgrade to this version or later to remediate the vulnerability. Details about the fix can be found in the GnuPG Task T8049.

Workarounds

• Implement network-level filtering to block or quarantine suspicious OpenPGP packets with unusually long signature length values
• Restrict processing of signatures from untrusted sources where possible
• Run GnuPG operations in sandboxed environments to contain the impact of potential crashes

# Check current GnuPG version and upgrade if necessary
gpg --version

# On Debian/Ubuntu systems, update GnuPG
sudo apt update && sudo apt upgrade gnupg

# On RHEL/CentOS systems
sudo yum update gnupg2

# Verify the upgraded version
gpg --version | head -1
# Should show: gpg (GnuPG) 2.5.17 or higher