In GnuPG versions before 2.5.17 a crafted signature packet with an excessively long length can be parsed successfully while the internal data structure receives a NULL assignment. When subsequent operations access the data, the application crashes, causing a denial of service. The weakness is a NULL pointer dereference as identified by CWE‑476.

Vendor: GnuPG. Product: GnuPG. Versions affected are all releases prior to 2.5.17, including the libraries bundled in GPG4Win deployments.

The CVSS score is 3.7, indicating a moderate impact level when the vulnerability is exercised. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to provide an adversarial signature packet to a system running GnuPG, which then crashes the application. The attack vector is inferred from the nature of the bug; no public exploitation is reported.