GCVE - cpe:2.3:a:gpg4win:gpg4win:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gpg4win:gpg4win:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gpg4Win (`d8ee5916-1712-549e-b011-a2b07c5bb58c`)
Product	Gpg4Win (`ad7049b5-90d9-5a3e-b64b-2481ffc64102`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/andrey-legayev/gpg4win`	purl2cpe	2026-06-01 10:13:20.691057
`pkg:github/gpg/gpg4win`	purl2cpe	2026-06-01 10:13:20.691059

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-24883`	vulnerable	2026-06-08 07:53:18.620724	Details available LOW (3.7) In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash). Published: 2026-01-27T18:43:18.883Z Updated: 2026-01-28T15:52:11.076Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2026/01/27/8 https://dev.gnupg.org/T8049	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24882`	vulnerable	2026-06-08 07:53:18.619883	Details available HIGH (8.4) In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. Published: 2026-01-27T18:40:18.166Z Updated: 2026-07-15T01:16:43.100Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2026/01/27/8 https://dev.gnupg.org/T8045	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24881`	vulnerable	2026-06-08 07:53:18.619273	Details available HIGH (8.1) In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that could lead to remote code execution. Published: 2026-01-27T18:36:56.727Z Updated: 2026-07-15T01:16:45.277Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2026/01/27/8 https://dev.gnupg.org/T8044	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-3515`	vulnerable	2026-06-08 05:48:21.325642	Details available A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. Published: 2023-01-12T00:00:00.000Z Updated: 2025-04-08T15:48:31.667Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=2135610 https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b https://access.redhat.com/security/cve/CVE-2022-3515 https://security.netapp.com/advisory/ntap-20230706-0008/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Gpg4Win

Notes

PURL mappings

Vulnerability references

Contribute