CVE-2025-68972 | THREATINT

Description

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

PUBLISHED Reserved 2025-12-27 | Published 2025-12-27 | Updated 2025-12-27 | Assigner mitre

MEDIUM: 5.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Problem types

CWE-347 Improper Verification of Cryptographic Signature

Product status

Default status

unknown

Any version

affected

References

gpg.fail/formfeed

news.ycombinator.com/item?id=46404339

cve.org (CVE-2025-68972)

nvd.nist.gov (CVE-2025-68972)

Download JSON