7.8

CVE-2025-68973: gnupg

CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2025-68973SUSE-SU-2026:0214-1SUSE-SU-2026:0215-1
Published 28-12-2025Last modified 30-04-2026
Open JSON

Vulnerability summary

CVE-2025-68973 is a high (CVSS 7.8) vulnerability in gnupg. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.9% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
MGASA-2026-0197USN-7946-1USN-7946-2

Timeline

  1. 28-12-2025
    PublishedVulnerability first disclosed.
  2. 30-04-2026
    Last modifiedVulnerability information updated.

Description

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.15% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse22 products
  • gpg2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.2.27-150300.3.16.1
  • gpg2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.2.27-150300.3.16.1
  • gpg2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.2.27-150300.3.16.1
  • gpg2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.2.27-150300.3.16.1
  • gpg2&distro=SUSE Linux Enterprise Micro 5.2< 2.2.27-150300.3.16.1
Redhat5 products
  • gnupg2< 0:2.4.5-3.el10_1 | < 0:2.3.3-5.el9_7 | < 0:2.2.20-4.el8_10 | < 0:2.2.20-3.el8_8.1 | < 0:2.2.20-3.el8_6.1 | < 0:2.2.20-2.el8_4.1 | < 0:2.3.3-4.el9_6.1 | < 0:2.3.3-4.el9_4.1 | < 0:2.2.9-1.el8_2.1 | < 0:2.4.5-2.el10_0.1 | < 0:2.0.22-5.el7_9.1 | < 0:2.3.3-2.el9_2.1 | < 0:2.3.3-2.el9_0.1
  • gnupg2-debuginfo< 0:2.4.5-3.el10_1 | < 0:2.3.3-5.el9_7 | < 0:2.2.20-4.el8_10 | < 0:2.4.5-2.el10_0.1 | < 0:2.0.22-5.el7_9.1 | < 0:2.3.3-2.el9_2.1 | < 0:2.3.3-2.el9_0.1
  • gnupg2-debugsource< 0:2.4.5-3.el10_1 | < 0:2.3.3-5.el9_7 | < 0:2.2.20-4.el8_10 | < 0:2.4.5-2.el10_0.1 | < 0:2.3.3-2.el9_2.1 | < 0:2.3.3-2.el9_0.1
  • gnupg2-smime< 0:2.4.5-3.el10_1 | < 0:2.3.3-5.el9_7 | < 0:2.2.20-4.el8_10 | < 0:2.2.20-3.el8_8.1 | < 0:2.2.20-3.el8_6.1 | < 0:2.2.20-2.el8_4.1 | < 0:2.3.3-4.el9_6.1 | < 0:2.3.3-4.el9_4.1 | < 0:2.2.9-1.el8_2.1 | < 0:2.4.5-2.el10_0.1 | < 0:2.0.22-5.el7_9.1 | < 0:2.3.3-2.el9_2.1 | < 0:2.3.3-2.el9_0.1
  • gnupg2-smime-debuginfo< 0:2.4.5-3.el10_1 | < 0:2.3.3-5.el9_7 | < 0:2.2.20-4.el8_10 | < 0:2.4.5-2.el10_0.1 | < 0:2.3.3-2.el9_2.1 | < 0:2.3.3-2.el9_0.1
Opensuse3 products
  • gpg2&distro=openSUSE Leap 15.6< 2.4.4-150600.3.12.1
  • gpg2&distro=openSUSE Leap 16.0< 2.5.5-160000.3.1
  • gpg2&distro=openSUSE Tumbleweed< 2.5.16-1.1
Ubuntu2 products
  • gnupg< 1.4.16-1ubuntu2.6+esm2 | < 1.4.20-1ubuntu3.3+esm3
  • gnupg2< 2.1.11-6ubuntu2.1+esm3 | < 2.2.4-1ubuntu1.6+esm2 | < 2.2.19-3ubuntu2.5+esm1 | < 2.2.27-3ubuntu2.5 | < 2.4.4-2ubuntu17.4 | < 2.4.8-2ubuntu2.1
Alpine1 product
  • gnupg< 2.4.9-r0
Debian1 product
  • gnupg2< 2.2.27-2+deb11u3 | < 2.2.40-1.1+deb12u2 | < 2.4.7-21+deb13u1 | < 2.4.8-5
Gnupg1 product
  • gnupg< 2.2.51 | ≥ 2.3.0, < 2.4.9 | ≤ 2.4.8

7 vendors · 35 products

References

63 links
Show all 63 references