PT-2025-53629 · Gnupg+2 · Gnupg+2

Mikko Hyppönen · Published 2025-12-27 · Updated 2026-05-05 · CVE-2025-68972

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GnuPG versions through 2.4.8

Description The software is susceptible to a signature verification bypass. If a signed message includes the character 'f' at the end of a plaintext line, an attacker can modify the message to add text after the signed content. Despite this modification, signature verification may succeed, although an "invalid armor" message might be displayed during the verification process. This issue is related to the use of 'f' as a marker to indicate the truncation of long plaintext lines.

Recommendations Update GnuPG to a version newer than 2.4.8.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

AZL-73192

AZL-73911

BDU:2026-05146

CVE-2025-68972

ECHO-7DA4-E7C5-9582

RHSA-2026:7458

Affected Products

Debian

Gnupg

Red Os

References · 31

• 🔥 https://gpg.fail/formfeed · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-68972 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-68972 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05146 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-68972 · Security Note
• https://osv.dev/vulnerability/AZL-73192 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-73911 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-68972 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2025-68972 · Vendor Advisory