CVE-2026-24883: 
NixOS vulnerability analysis and mitigation

CVE-2026-24883 is a NULL pointer dereference vulnerability in GnuPG that causes a denial of service (application crash) when processing a specially crafted signature packet with an excessively long packet length. The flaw exists in the parse_signature function, which returns success while leaving sig->data[] set to NULL, causing a crash in downstream consumers. Affected versions include GnuPG 2.5.13 through 2.5.16 and Gpg4win 5.0.0 (including beta releases); GnuPG 2.5.17 and Gpg4win 5.0.1 resolve the issue. It was publicly disclosed on January 27, 2026, with a CVSS v3.1 base score of 5.5 (Medium) per Feedly/NVD, though ENISA's EUVD rates it 3.7 (Low) (Red Hat Advisory, oss-security).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and was introduced in a specific GnuPG 2.5.x commit (rG36dbca3e6944d13e75e96eace634e58a7d7e201d), meaning only the 2.5.x branch is affected — RHEL and Fedora stable releases are not impacted (Red Hat Bugzilla). When parse_signature encounters a signature packet with an overlong declared length, it returns a success status without properly allocating or populating the sig->data[] array, leaving it NULL. Any subsequent code that dereferences this pointer without a NULL check will trigger a crash. The attack vector is local (CVSS AV:L) with low privileges required and no user interaction needed, though ENISA's scoring suggests a network-reachable path with high complexity is also plausible depending on how GnuPG is integrated (GnuPG Tracker, oss-security).

Successful exploitation results in a denial of service through an application crash, with no confidentiality or integrity impact. An attacker who can supply a malformed signature packet — either locally or via a network-delivered signed message processed by GnuPG — can crash the affected application. The vulnerability's scope is limited to availability, and there is no evidence of lateral movement potential or data exposure risk beyond service disruption (Red Hat Advisory, GnuPG Tracker).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Red Hat Advisory). The EPSS score is extremely low at 0.0001 (0.01%), reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target: Locate a system running GnuPG 2.5.13–2.5.16 or Gpg4win 5.0.0 that processes externally supplied signature packets (e.g., verifying signed emails or files).
2. Craft a malformed signature packet: Construct an OpenPGP signature packet with an excessively long declared packet length field that exceeds what parse_signature properly handles, causing it to return success with sig->data[] left as NULL.
3. Deliver the packet: Supply the crafted packet to the target — either as a local file passed to gpg --verify, or embedded in a signed S/MIME or OpenPGP message processed by an application using GnuPG.
4. Trigger the crash: When GnuPG's downstream code attempts to dereference the NULL sig->data[] pointer, the process crashes, achieving denial of service (GnuPG Tracker, oss-security).

• Logs: Unexpected GnuPG process crashes or segmentation fault entries in system logs (e.g., journalctl, /var/log/syslog) referencing gpg or gpgsm processes.
• Process: Abnormal termination of gpg, gpgsm, or gpg-agent processes with signal 11 (SIGSEGV) or signal 6 (SIGABRT).
• File System: Presence of core dump files (e.g., core.*) in the working directory of GnuPG processes, potentially indicating repeated crash attempts.
• Network: If GnuPG is used in a mail processing pipeline, unusual volumes of malformed or oversized signature packets arriving via email or other channels.

Upgrade GnuPG to version 2.5.17 or later, and Gpg4win to version 5.0.1 or later, which contain the fix for this vulnerability (oss-security, GnuPG Tracker). Red Hat confirmed that RHEL and Fedora stable releases are not affected, as the vulnerable code was only introduced in the GnuPG 2.5.x development branch (Red Hat Bugzilla). Given the low CVSS score and absence of active exploitation, patching can be scheduled within standard update cycles unless GnuPG is exposed to untrusted signature sources.

The vulnerability was disclosed alongside two other GnuPG security issues in the same 2.5.17 release, including a more severe potential RCE (T8044), which drew more community attention (oss-security). Red Hat's product security team confirmed no impact to RHEL or Fedora, reducing urgency for enterprise Linux users (Red Hat Bugzilla). OpenSUSE Tumbleweed included the fix in its January 2026 monthly update, and the Yocto Project security mailing list tracked the issue for embedded Linux distributions.