CVE-2025-68972: gnupg
Vulnerability summary
CVE-2025-68972 is a medium (CVSS 5.9) vulnerability in gnupg. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.3% of scored vulnerabilities.
Timeline
- 27-12-2025PublishedVulnerability first disclosed.
- 02-01-2026Last modifiedVulnerability information updated.
Description
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · AlpineEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- NVDNIST4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
0.00 pp
From 0.11% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat11 products
- gnupg2< 0:2.4.9-5.1.hum1
- gnupg2-dirmngr< 0:2.4.9-5.1.hum1
- gnupg2-g13< 0:2.4.9-5.1.hum1
- gnupg2-gpg-agent< 0:2.4.9-5.1.hum1
- gnupg2-gpgconf< 0:2.4.9-5.1.hum1
Alpine1 product
- gnupg< 2.4.9-r0
Debian1 product
- gnupg2All versions (No fix recorded)
Gnupg1 product
- gnupg≤ 2.4.8
Ubuntu1 product
- gnupg2All versions (No fix recorded)
5 vendors · 15 products
References
14 links- images.redhat.comARTICLE
