Description
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
Problem types
CWE-675 Multiple Operations on Resource in Single-Operation Context
Product status
Any version before 2.2.51
2.3.0 (semver) before 2.4.9
References
gpg.fail/memcpy
www.openwall.com/lists/oss-security/2025/12/29/11
lists.debian.org/debian-lts-announce/2026/01/msg00008.html
news.ycombinator.com/item?id=46403200
www.openwall.com/lists/oss-security/2025/12/28/5
github.com/...ommit/115d138ba599328005c5321c0ef9f00355838ca9
github.com/...3418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c
github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51
media.ccc.de/...n-or-not-to-sign-practical-vulnerabilities-i