CVE-2024-53856
rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.45%
- CWE
- CWE-130, CWE-148, CWE-617
- Published
- 2024-12-05
- Last modified
- 2026-03-13
Affected products
- rpgp rpgp
Weakness type
Related vulnerabilities
- CVE-2026-71337 — Windows Storage Management Provider Elevation of Privilege Vulnerability
- CVE-2026-5706 — Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements
- CVE-2026-71402 — wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
- CVE-2026-81575 — Missing Sanity Checks for Buffer Lengths
- CVE-2026-58097 — ppp(8): missing length validation in mp_SetEnddisc()
- CVE-2026-58096 — ppp(8): missing length validation in LcpDecodeConfig()
- CVE-2026-14587 — Unathenticated connection can hold Bolt channel open
- CVE-2026-67292 — FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure