Stack-based buffer overflow in GnuPG tpm2daemon PKDECRYPT

CVE-2026-24882 is a stack-based buffer overflow in GnuPG before 2.5.17 affecting tpm2daemon, the helper process used for cryptographic operations when private keys are stored in a TPM. The flaw occurs during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys. Other GnuPG components communicate with tpm2daemon over the local Assuan IPC socket. During a PKDECRYPT request, tpm2daemon copies attacker-supplied ciphertext into fixed-size TPM work buffers without properly validating the ciphertext length. If the supplied ciphertext exceeds the TPM buffer size, the copy operation writes past the end of a stack buffer and corrupts adjacent stack memory. The vulnerable condition affects both supported TPM decrypt paths, tpm2_rsa_decrypt and tpm2_ecc_decrypt.