USN-7412-2
gnupg2 regression
USN-7412-1 fixed vulnerabilities in GnuPG. The update introduced a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that GnuPG incorrectly handled importing keys with certain crafted subkey data. If a user or automated system were tricked into importing a specially crafted key, a remote attacker may prevent users from importing other keys in the future.
What each source reports
OSV No score
gnupg2 regression
USN-7412-1 fixed vulnerabilities in GnuPG. The update introduced a regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that GnuPG incorrectly handled importing keys with certain crafted subkey data. If a user or automated system were tricked into importing a specially crafted key, a remote attacker may prevent users from importing other keys in the future.
- Record
USN-7412-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnupg2Ubuntu:22.04:LTS |
before 2.2.27-3ubuntu2.4, plus listed versions 2.2.20-1ubuntu42.2.27-2ubuntu12.2.27-3ubuntu12.2.27-3ubuntu22.2.27-3ubuntu2.12.2.27-3ubuntu2.3 |
2.2.27-3ubuntu2.4 |
gnupg2Ubuntu:24.04:LTS |
before 2.4.4-2ubuntu17.3, plus listed versions 2.2.40-1.1ubuntu12.4.4-2ubuntu72.4.4-2ubuntu152.4.4-2ubuntu162.4.4-2ubuntu172.4.4-2ubuntu17.2 |
2.4.4-2ubuntu17.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-7412-2 is a vulnerability with no CVSS score yet in gnupg2, published July 8, 2025. No source lists public exploit code. Fixed in gnupg2 2.2.27-3ubuntu2.4.