CVE-2026-24882: 
NixOS vulnerability analysis and mitigation

CVE-2026-24882 is a stack-based buffer overflow vulnerability in GnuPG's tpm2daemon component, triggered during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. It affects GnuPG versions 2.5.13 through 2.5.16 and Gpg4win versions 5.0.0 (including beta releases). The vulnerability was publicly disclosed on January 27, 2026, following a fixed release of GnuPG 2.5.17 (oss-security). It carries a CVSS v3.1 base score of 7.8 (High) per NVD, and 8.4 (High) per ENISA's EUVD scoring (Red Hat CVE, Feedly).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). When tpm2daemon processes a PKDECRYPT request over the Assuan local IPC socket, it copies attacker-supplied ciphertext into fixed-size TPM work buffers without validating that the ciphertext length fits within the buffer. If the supplied ciphertext exceeds the buffer size, the copy operation writes past the end of the stack buffer, corrupting adjacent stack memory. Both RSA (tpm2_rsa_decrypt) and ECC (tpm2_ecc_decrypt) decrypt paths are affected. Because the overflow is attacker-controlled and occurs on the stack, it is potentially exploitable for arbitrary code execution within the tpm2daemon process (oss-security, GnuPG tracker).

A local attacker with access to the tpm2daemon Assuan socket — requiring only low privileges — can trigger memory corruption leading to a crash or arbitrary code execution with daemon privileges. Successful exploitation results in high impact to confidentiality, integrity, and availability of the affected system. In multi-user environments, this could allow privilege escalation or compromise of TPM-protected private key material (oss-security, Red Hat Bugzilla).

A proof-of-concept reference exists at the GnuPG issue tracker (T8045), noted as an exploit reference by NVD (GnuPG tracker). There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.005% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the Assuan socket, limiting the attack surface compared to network-exploitable vulnerabilities (Feedly).

1. Reconnaissance: Identify systems running GnuPG 2.5.13–2.5.16 or Gpg4win 5.0.0 with TPM-backed private keys configured, where tpm2daemon is running.
2. Locate the Assuan socket: As a local user, find the tpm2daemon Assuan IPC socket path (typically under the GnuPG home directory, e.g., /run/user/<UID>/gnupg/S.tpm2daemon).
3. Craft oversized ciphertext: Prepare a PKDECRYPT Assuan command containing a ciphertext payload that exceeds the fixed-size TPM work buffer (the exact size depends on the compiled buffer dimensions in the affected version).
4. Send the malicious command: Connect to the Assuan socket and transmit the crafted PKDECRYPT command with the oversized ciphertext, triggering the stack buffer overflow in tpm2_rsa_decrypt or tpm2_ecc_decrypt.
5. Achieve code execution: If the overflow is crafted to overwrite the return address or function pointer on the stack with a controlled value, arbitrary code execution within the tpm2daemon process is achieved (oss-security, GnuPG tracker).

• Process: Unexpected crashes or restarts of the tpm2daemon process; unusual child processes spawned by tpm2daemon (e.g., shells or network utilities).
• Logs: System logs (e.g., journalctl, /var/log/syslog) showing segmentation faults or abnormal termination of tpm2daemon; GnuPG agent logs recording malformed or oversized PKDECRYPT requests.
• File System: Unexpected files written to the GnuPG home directory or /tmp by the tpm2daemon process; new or modified binaries in system paths owned by the daemon's UID.
• Network: (Limited applicability — exploitation is local) Unusual outbound connections from the host following tpm2daemon crashes, potentially indicating post-exploitation activity.

Update GnuPG to version 2.5.17 or later, and Gpg4win to version 5.0.1 or later, which contain the fix for this vulnerability (oss-security). Red Hat Enterprise Linux 10 users should apply RHSA-2026:2719 or RHSA-2026:2753 as applicable (Red Hat Bugzilla). As an interim workaround where patching is not immediately possible, restrict local system access to the tpm2daemon Assuan socket to trusted users only, and monitor for suspicious daemon activity. Systems running GnuPG 2.5.13–2.5.16 should be treated as highest priority for patching.

The vulnerability was discovered by OpenAI Security Research and reported to the GnuPG project on January 18, 2026, with fixed versions released on January 27, 2026 (oss-security). OpenAI's Codex Security tool was highlighted in subsequent media coverage as having scanned 1.2 million code commits and identified this and other high-severity issues, drawing attention from security news outlets including The Hacker News (The Hacker News). The disclosure was covered by the oss-security mailing list and noted in CISA's weekly vulnerability bulletin for the week of January 26, 2026.