CVE catalog

CVE-2025-68972

gnupg2: CVE-2025-68972

Severity: Medium · CVSS 5.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Published: Dec 27, 2025, 10:52:30 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.11% · Oct 25, 2026

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gnupg2	sid	`2.4.9-8`	vulnerable
Debian	gnupg2	forky	`2.4.9-8`	vulnerable
Debian	gnupg2	trixie	`2.4.7-21+deb13u1`	vulnerable
Debian	gnupg2	bookworm	`2.2.40-1.1+deb12u2`	vulnerable
Cpe	gnupg	Not reported	Not reported	unknown
Alpine	gnupg	3.20	`2.4.9-r0`	fixed
Alpine	gnupg	3.21	`2.4.9-r0`	fixed
Alpine	gnupg	3.22	`2.4.9-r0`	fixed
Alpine	gnupg	3.23	`2.4.9-r0`	fixed
Alpine	gnupg	3.24	`2.4.9-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gnupg2	source	sid	`(unfixed)`	not yet assigned	Not reported	[1124220]
Debian	gnupg2	source	forky	`(unfixed)`	not yet assigned	Not reported	[1124220]
Debian	gnupg2	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1124220]
Debian	gnupg2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1124220]
Alpine	gnupg	apk	3.20	`2.4.9-r0`	Not reported	ALPINE-CVE-2025-68972	Not reported
Alpine	gnupg	apk	3.21	`2.4.9-r0`	Not reported	ALPINE-CVE-2025-68972	Not reported
Alpine	gnupg	apk	3.22	`2.4.9-r0`	Not reported	ALPINE-CVE-2025-68972	Not reported
Alpine	gnupg	apk	3.23	`2.4.9-r0`	Not reported	ALPINE-CVE-2025-68972	Not reported
Alpine	gnupg	apk	3.24	`2.4.9-r0`	Not reported	ALPINE-CVE-2025-68972	Not reported

[Debian bug #1124220]

Notes

[trixie] gnupg2: Minor issue [bookworm] gnupg2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[dirmngr]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gnupg]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gnupg2]Affected
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gnupg-agent]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gnupg-l10n]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gnupg-utils]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpg]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpg-agent]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgconf]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgsm]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgv]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgv2]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgv-static]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpgv-win32]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · all · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpg-wks-client]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[gpg-wks-server]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
[scdaemon]Affected
Source package: [gnupg2]
Details (2)
- 2.2.40-1.1+deb12u2 · amd64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm
- 2.2.40-1.1+deb12u2 · arm64 · bookworm
  Affected
  dsa · gnupg2 · debian · bookworm

Observed: Oct 24, 2026, 7:46:19 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]