CVE-2025-68972

Description

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

PUBLISHED Reserved 2025-12-27 | Published 2025-12-27 | Updated 2026-01-02 | Assigner mitre

Problem types

CWE-347 Improper Verification of Cryptographic Signature

Product status

References

gpg.fail/formfeed exploit

gpg.fail/formfeed

news.ycombinator.com/item?id=46404339

media.ccc.de/...n-or-not-to-sign-practical-vulnerabilities-i

cve.org (CVE-2025-68972)

nvd.nist.gov (CVE-2025-68972)

Download JSON