PatchTheCVECVE-2025-68972: In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct
CVE-2025-68972 is a medium-severity flaw (CVSS 5.9) affecting gnupg. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2025-12-27 |
| Last modified | 2026-10-13 |
Last updated 2026-10-13 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-68972?
gnupg: upgrade to newer than 2.4.8. Exact commands for each OS are on this page.
Is CVE-2025-68972 being exploited?
CVE-2025-68972 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-68972 affect?
CVE-2025-68972 affects gnupg. Severity is medium (CVSS 5.9). In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message
How urgent is CVE-2025-68972?
Priority 21/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-68973 HIGH 7.8 UPGRADE In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intend
- CVE-2026-24882 HIGH 8.4 UPGRADE UPGRADE In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT co
- CVE-2026-24881 HIGH 8.1 UPGRADE UPGRADE In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key
- CVE-2026-24883 LOW 3.7 UPGRADE UPGRADE In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data
- CVE-2025-30258 LOW 2.7 UPGRADE In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a