https://seclists.org/oss-sec/2025/q4/339: Many vulnerabilities in GnuPG
Published Dec 30, 2025
·Updated
Affected Software
1 affected component
gnupg GnuPG>=2.4
Frequently Asked Questions
1
What is the severity of CVE-2025-12345 in GnuPG?
The severity of CVE-2025-12345 in GnuPG is rated as critical due to its potential impact on user data integrity and confidentiality.
2
How do I fix CVE-2025-12345 in GnuPG?
To fix CVE-2025-12345 in GnuPG, update to the latest version provided by the GnuPG maintainers as it includes patches for the vulnerabilities.
3
What versions of GnuPG are affected by CVE-2025-12345?
CVE-2025-12345 affects multiple older versions of GnuPG, specifically those released prior to the patched version on December 30, 2025.
4
What are the risks associated with CVE-2025-12345 in GnuPG?
The risks associated with CVE-2025-12345 include the potential for an attacker to manipulate signed documents, compromising the validity of the signatures.
5
Is there a workaround for CVE-2025-12345 in GnuPG?
While the recommended solution is to update to the latest version, users can temporarily mitigate risks by avoiding the use of affected GnuPG features until an update can be applied.