It's difficult to be precise, but I'd bid it out as a minimum of 6 orders of magnitude less, and if someone wanted to bid out 8 or 9 I wouldn't fight them.

It's not a zero-impact issue, but there's so many differences between this and Heartbleed that it just can't be that large. For one thing, there's several orders of magnitude fewer users of GPG than SSL. Then you need a vulnerable configuration. Then you need to have been exploited. Those three things multiply out to quite a few orders of magnitude.

Approximately 0 Heartbleeds.

A Heartbleed-level vulnerability means "everyone is vulnerable, exploitation is trivial, consequences of exploitation are severe" so therefore you need to a) update yesterday and b) assume that the fact you haven't updated yet (because you just found out) means you've already been screwed. These kind of bugs are very rare, and the only comparable one I can think of is Debian's OpenSSL bug.

The attack can only succeed when victim's gpg is run with 'verbose' option turned on. Which is rather unusual situation.