Every CVE Search/ Get API key

CVE-2025-68972

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary...

5.9 MediumFix available

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.11%Up 0.1 points since Dec 28, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
EUVDEUVD-2025-205487 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
EUVD-2025-205487
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w789-3q45-984r 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary...

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
GHSA-w789-3q45-984r
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
NVD 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-347
Updated
2026-11-02
OSVALPINE-CVE-2025-68972 4.7

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
ALPINE-CVE-2025-68972
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2025-68972 4.7
Record
BELL-CVE-2025-68972
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 12 moreShow less
OSV 4.7

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
CVE-2025-68972
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-68972 4.7

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
DEBIAN-CVE-2025-68972
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVJLSEC-2026-562 4.7

In GnuPG through 2.4.8, if a signed message has `\f` at the end of a plaintext line, an adversary...

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
JLSEC-2026-562
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:7458 5.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:7458
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-68972 5.9

CVE-2025-68972 in gnupg2 - Patched by Root

Root has patched CVE-2025-68972 in the gnupg2 package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-68972 5.9

CVE-2025-68972 in gnupg2 - Patched by Root

Root has patched CVE-2025-68972 in the gnupg2 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2204-CVE-2025-68972 5.9

CVE-2025-68972 in gnupg2 - Patched by Root

Root has patched CVE-2025-68972 in the gnupg2 package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2204-CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVROOT-OS-UBUNTU-2404-CVE-2025-68972 5.9

CVE-2025-68972 in gnupg2 - Patched by Root

Root has patched CVE-2025-68972 in the gnupg2 package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record
ROOT-OS-UBUNTU-2404-CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-68972 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
UBUNTU-CVE-2025-68972
CVSS 3.1
5.9 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVAZL-73192 No score

CVE-2025-68972 affecting package gnupg2 for versions less than 2.4.9-1

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
AZL-73192
Updated
2026-11-02
OSVAZL-73911 No score

CVE-2025-68972 affecting package gnupg2 2.4.0-3

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Record
AZL-73911
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-68972 No score

CVE-2025-68972 in rootio-gnupg2 - Patched by Root

Root has patched CVE-2025-68972 in the rootio-gnupg2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-68972
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gnupg
Alpine:v3.20
 before 2.4.9-r0
2.4.9-r0
gnupg
Alpine:v3.21
 before 2.4.9-r0
2.4.9-r0
gnupg
Alpine:v3.22
 before 2.4.9-r0
2.4.9-r0
gnupg
Alpine:v3.23
 before 2.4.9-r0
2.4.9-r0
gnupg
Alpine:v3.24
 before 2.4.9-r0
2.4.9-r0
gnupg2
Azure Linux:3
 before 2.4.9-1
2.4.9-1
gnupg2
Azure Linux:2
 through 2.4.0-3 None known
gnupg
Alpaquita:25
 2.4.7-r0 up to 2.4.9-r0
2.4.9-r0
gnupg
Alpaquita:stream
 2.4.0-r1 up to 2.4.9-r0
2.4.9-r0
gnupg2
Debian:12
 All versions, plus listed versions
2.2.40-1.12.2.40-1.1+deb12u12.2.40-1.1+deb12u22.2.40-1.1+hurd.12.2.40-1.1+loong64
Show 45 moreShow less
2.2.40-22.2.40-32.2.43-12.2.43-22.2.43-32.2.43-42.2.43-52.2.43-62.2.43-72.2.43-82.2.44-12.2.45-12.2.45-22.2.45-32.2.46-12.2.46-22.2.46-32.2.46-42.2.46-52.2.46-62.2.46~pre1-12.3.1-12.4.3-22.4.4-12.4.4-22.4.4-32.4.4-42.4.5-12.4.5-22.4.5-32.4.6-12.4.7-12.4.7-102.4.7-112.4.7-122.4.7-132.4.7-142.4.7-152.4.7-162.4.7-172.4.7-182.4.7-192.4.7-22.4.7-202.4.7-21
 None known
Show 20 moreShow less
Affected packages
PackageAffectedFixed
gnupg2
Debian:13
 All versions, plus listed versions
2.4.7-212.4.7-21+deb13u12.4.8-12.4.8-22.4.8-3
Show 11 moreShow less
2.4.8-42.4.8-52.4.8-62.4.9-12.4.9-22.4.9-32.4.9-42.4.9-52.4.9-62.4.9-72.4.9-8
 None known
gnupg2
Debian:14
 All versions, plus listed versions
2.4.7-212.4.8-12.4.8-22.4.8-32.4.8-4
Show 10 moreShow less
2.4.8-52.4.8-62.4.9-12.4.9-22.4.9-32.4.9-42.4.9-52.4.9-62.4.9-72.4.9-8
 None known
GnuPG_jll
Julia
 before 2.5.16+0
2.5.16+0
gnupg2
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-dirmngr
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-g13
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-gpg-agent
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-gpgconf
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-keyboxd
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-scdaemon
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-smime
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-utils
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-verify
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2-wks
Red Hat:hummingbird:1
 before 0:2.4.9-5.1.hum1
0:2.4.9-5.1.hum1
gnupg2
Root:Debian:11
 before 2.2.27-2+deb11u3.aikido.4
2.2.27-2+deb11u3.aikido.42.2.27-2+deb11u3.aikido.5
rootio-gnupg2
Root:Debian:11
 before 2.2.27-2+deb11u3.aikido.4
2.2.27-2+deb11u3.aikido.42.2.27-2+deb11u3.aikido.5
gnupg2
Root:Debian:13
 before 2.4.7-21+deb13u1.root.io.1
2.4.7-21+deb13u1.root.io.12.4.7-21+deb13u1.root.io.22.4.7-21+deb13u1.root.io.32.4.7-21+deb13u1.aikido.52.4.7-21+deb13u1.root.io.42.4.7-21+deb13u1.aikido.62.4.7-21+deb13u1.aikido.72.4.7-21+deb13u1.aikido.82.4.7-21+deb13u1.aikido.92.4.7-21+deb13u1.aikido.102.4.7-21+deb13u1.aikido.11
rootio-gnupg2
Root:Debian:13
 before 2.4.7-21+deb13u1.root.io.1
2.4.7-21+deb13u1.root.io.12.4.7-21+deb13u1.root.io.22.4.7-21+deb13u1.root.io.32.4.7-21+deb13u1.aikido.52.4.7-21+deb13u1.root.io.42.4.7-21+deb13u1.aikido.62.4.7-21+deb13u1.aikido.72.4.7-21+deb13u1.aikido.82.4.7-21+deb13u1.aikido.92.4.7-21+deb13u1.aikido.102.4.7-21+deb13u1.aikido.11
gnupg2
Root:Ubuntu:22.04
 before 2.2.27-3ubuntu2.5.root.io.2
2.2.27-3ubuntu2.5.root.io.22.2.27-3ubuntu2.5.aikido.42.2.27-3ubuntu2.5.aikido.32.2.27-3ubuntu2.5.aikido.5
rootio-gnupg2
Root:Ubuntu:22.04
 before 2.2.27-3ubuntu2.5.root.io.2
2.2.27-3ubuntu2.5.root.io.22.2.27-3ubuntu2.5.aikido.42.2.27-3ubuntu2.5.aikido.32.2.27-3ubuntu2.5.aikido.5

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-68972 is a medium vulnerability (CVSS 5.9) in Gnupg, published December 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in gnupg 2.4.9-r0.

References

Show 10 moreShow less
This page doesn't list everything

Left out here: 21 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open