CVE-2025-68972 Security feature bypass in GnuPG
An attacker can append text to signed messages by exploiting form feed handling, bypassing signature verification integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68972?
CVE-2025-68972 is a medium-severity vulnerability in GnuPG, published on 27 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Weakness: CWE-347
Which versions are affected by CVE-2025-68972?
It affects 1 product.
Linux distribution packages (11)
gnupg2 Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-dirmngr Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-g13 Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-gpg-agent Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-gpgconf Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-keyboxd Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-scdaemon Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-smime Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-utils Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-verify Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
gnupg2-wks Red Hat:hummingbird:1 | All versions | 0:2.4.9-5.1.hum1 |
Products include Gnupg Gnupg.
How do I fix CVE-2025-68972?
Upgrade to a fixed version.
Is CVE-2025-68972 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68972 exists.
Other vulnerabilities in GnuPG
Sources
Also known as ALPINE-CVE-2025-68972, AZL-73192, AZL-73911, BELL-CVE-2025-68972, DEBIAN-CVE-2025-68972, GHSA-w789-3q45-984r and 6 more.