https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24883.htmlhttps://patchthecve.com/cve/CVE-2026-24883.htmlWed, 17 Jun 2026 10:23:44 +0000LOW 3.7: In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).https://patchthecve.com/cve/CVE-2026-24882.htmlhttps://patchthecve.com/cve/CVE-2026-24882.htmlWed, 15 Jul 2026 02:18:52 +0000HIGH 8.4: In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.https://patchthecve.com/cve/CVE-2026-24881.htmlhttps://patchthecve.com/cve/CVE-2026-24881.htmlWed, 15 Jul 2026 02:18:52 +0000HIGH 8.1: In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of service; however, there is also memory corruption that co