A critical stack-based buffer overflow vulnerability in GnuPG allows unauthenticated remote attackers to achieve remote code execution or system crashes.

The vulnerability is a stack-based buffer overflow (CWE-121) triggered within gpg-agent during the processing of a maliciously crafted CMS (S/MIME) EnvelopedData message containing an oversized wrapped session key. This flaw is reachable by unauthenticated remote attackers.

The ability for an unauthenticated attacker to execute arbitrary code on a system running GnuPG presents a severe risk to confidentiality, integrity, and availability. With a CVSS score of 8.1, the potential for remote code execution could lead to full system compromise, unauthorized access to sensitive cryptographic material, or persistent denial of service, causing significant operational disruption.

Immediate Action: Update GnuPG installations to version 2.5.17 or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review system and application logs for unusual crashes or termination events associated with the gpg-agent process.

Compensating Controls: Implement network-level filtering to restrict access to services utilizing GnuPG/S/MIME parsing if immediate patching is not feasible.

Public Exploit Available: Unknown.

This vulnerability represents a high-severity risk due to its potential for remote code execution within a critical security component. Organizations should prioritize updating their GnuPG deployments to version 2.5.17 immediately to eliminate the underlying buffer overflow condition. Failure to patch leaves systems vulnerable to memory corruption attacks that could bypass existing security controls.