CVE-2025-68972: Medium severity gnupg GnuPG vulnerability
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.9-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68972?
CVE-2025-68972 is classified as a high-severity vulnerability due to its potential for misuse in signature verification.
How do I fix CVE-2025-68972?
To fix CVE-2025-68972, users should upgrade GnuPG to version 2.4.9 or later.
What software is affected by CVE-2025-68972?
CVE-2025-68972 affects GnuPG versions up to and including 2.4.8.
What type of attack does CVE-2025-68972 enable?
CVE-2025-68972 enables an adversary to manipulate signed messages to succeed in signature verification despite unauthorized modifications.
What should I do if I cannot upgrade due to compatibility issues related to CVE-2025-68972?
If upgrading is not possible, it's recommended to implement strict validation checks on all signed messages.