GCVE-1-2026-0008: gnupg gpg-agent Classic Buffer Overflow

Vulnerability summary

GCVE-1-2026-0008 is a critical (CVSS 10.0) Classic Buffer Overflow vulnerability in gnupg gpg-agent.

Timeline

1. 28-01-2026
   PublishedVulnerability first disclosed.

Description

A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key (AES Key Wrap ciphertext) can cause a stack buffer overflow in gpg-agent during PKDECRYPT --kem=CMS handling. The root cause is an unbounded session key length derived from attacker-controlled ciphertext and used as the AES Key Wrap output length when decrypting into a fixed-size stack buffer. libgcrypt’s AES-KW unwrap copies attacker-controlled bytes into the caller-provided output buffer before performing integrity checks, so the stack overflow occurs even if later CMS or key-wrap integrity validation fails.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.