CVE-2026-24882
📋 TL;DR
A stack-based buffer overflow vulnerability in GnuPG's tpm2daemon component allows attackers to execute arbitrary code or cause denial of service when processing PKDECRYPT commands for TPM-backed keys. This affects systems using GnuPG with TPM 2.0 hardware security modules for RSA/ECC key operations. The vulnerability is particularly dangerous in environments where GnuPG handles sensitive cryptographic operations.
💻 Affected Systems
- GnuPG (GPG)
- gnupg2
📦 What is this software?
Gnupg by Gnupg
Gpg4win by Gpg4win
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the tpm2daemon process (often root), potentially leading to complete system compromise, TPM key exfiltration, and lateral movement.
Likely Case
Denial of service through daemon crashes, with potential for limited code execution in constrained environments where exploit conditions are met.
If Mitigated
Minimal impact if tpm2daemon is not running, TPM-backed keys are not used, or proper network segmentation isolates vulnerable systems.
🎯 Exploit Status
Exploitation requires sending malformed PKDECRYPT commands to the tpm2daemon, which typically requires local or authenticated access. The buffer overflow is in a specific command handler, making exploitation more targeted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.17 and later
Vendor Advisory: https://dev.gnupg.org/T8045
Restart Required: Yes
Instructions:
1. Backup existing GnuPG configuration and keys. 2. Download GnuPG 2.5.17 or later from https://gnupg.org/download/. 3. Follow standard build/install procedures for your distribution. 4. Restart tpm2daemon and any dependent services.
🔧 Temporary Workarounds
Disable tpm2daemon
linuxStop and disable the tpm2daemon service if TPM-backed keys are not required
sudo systemctl stop tpm2daemon
sudo systemctl disable tpm2daemon
Network isolation
linuxEnsure tpm2daemon socket is only accessible locally and not exposed to network
sudo netstat -tlnp | grep tpm2daemon
Verify only local sockets (127.0.0.1 or ::1) are listed
🧯 If You Can't Patch
- Disable use of TPM-backed keys and switch to software-only keys
- Implement strict access controls to limit who can communicate with tpm2daemon socket
🔍 How to Verify
Check if Vulnerable:
Check GnuPG version and if tpm2daemon is running: 'gpg --version | head -1' and 'systemctl status tpm2daemon'Check Version:
gpg --version | head -1Verify Fix Applied:
Verify version is 2.5.17 or later: 'gpg --version | head -1' should show '2.5.17' or higher📡 Detection & Monitoring
Log Indicators:
- tpm2daemon crash logs in systemd journal
- Abnormal PKDECRYPT command patterns in GnuPG logs
- Core dumps from tpm2daemon process
Network Indicators:
- Unexpected connections to tpm2daemon socket (default: /run/user/<uid>/gnupg/S.tpm2daemon)
- Network traffic to local TPM-related ports
SIEM Query:
process_name:"tpm2daemon" AND (event_type:"crash" OR exit_code:139)