A crafted CMS (S/MIME) EnvelopedData message with an oversized wrapped session key can cause a stack‑based buffer overflow in gpg-agent during PKDECRYPT handling with the kem=CMS option. The overflow can lead to denial of service by crashing the agent, and the associated memory corruption could allow an attacker to execute arbitrary code. This vulnerability is classified as a CWE‑121 stack-based buffer overflow.

GnuPG versions before 2.5.17, including the gpg4win bundle that incorporates this GnuPG library, are vulnerable. Any system that processes CMS EnvelopedData through gpg-agent without updating to a fixed release is exposed.

The CVSS score is 8.1, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is likely to involve malicious S/MIME messages sent over email or other transport channels that the victim’s system processes locally. An attacker can simply craft a sending file to trigger the overflow, resulting in a service crash or potential code execution.