A stack-based buffer overflow vulnerability in GnuPG tpm2daemon versions prior to 2.5.17 poses a high risk of local system compromise.

The vulnerability is a stack-based buffer overflow (CWE-121) occurring within the tpm2daemon component. It is triggered when processing specific PKDECRYPT commands for TPM-backed RSA and ECC keys, and it does not require prior user authentication.

Successful exploitation of this buffer overflow can result in total compromise of the affected system, including unauthorized access to sensitive cryptographic keys and potential execution of arbitrary code with the privileges of the daemon. With a CVSS score of 8.4, this vulnerability represents a high-severity risk that could lead to significant data breaches and a loss of system integrity.

Immediate Action: Update the GnuPG software to version 2.5.17 or later to incorporate the vendor-provided patch for the tpm2daemon.

Proactive Monitoring: Review system logs for signs of abnormal daemon crashes or unexpected process behavior related to tpm2daemon.

Compensating Controls: Restrict access to the system hosting the TPM-backed keys to only authorized personnel to limit the local attack surface.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the critical nature of the affected component in managing cryptographic keys, immediate remediation is required. Organizations should prioritize updating GnuPG installations to version 2.5.17 to resolve this overflow vulnerability and prevent potential exploitation of their TPM-backed key infrastructure.