GnuPG Security Release (GnuPG 2.5.17) Key Information Vulnerability Fix: - GnuPG 2.5.17 addresses a potential Remote Code Execution (RCE) due to a stack buffer overflow in gpg-agent's PKDECRYPT command using Key Encapsulation Mechanism (KEM). Other Security Bugs: - Stack-based buffer overflow in TPM2 PKDECRYPT command for TPM-backed RSA and ECC keys. - Null pointer dereference with overly long signature packets. Affected Versions: - GnuPG 2.5.16, 2.5.15, 2.5.14, 2.5.13. - Gpg4win 5.0.0 (and beta versions). CVE Status: - No CVE-ID assigned. Tracked as T8044. Discoverer: - OpenAI Security Research. Release Date: - 2026-01-27. Solution: - Update to GnuPG 2.5.17. - If immediate update is not possible, remove or binary. Links Main Bug T8044 Second Bug T8045 Third Bug T8049 Advisory T7996#212268