CVE-2025-68973

Description

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Is your site exposed to CVE-2025-68973?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness Type (CWE)

CWE-675 CWE-675

CWE-787 Out-of-bounds Write

Affected Products

Vendor	Product	Versions
gnupg	gnupg	< 2.4.8

References

Advisories & Patches

https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9 https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51 http://www.openwall.com/lists/oss-security/2025/12/29/11

Other References

https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306 https://gpg.fail/memcpy https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i https://news.ycombinator.com/item?id=46403200 https://www.openwall.com/lists/oss-security/2025/12/28/5 https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html https://gpg.fail/memcpy

Frequently Asked Questions

What is CVE-2025-68973? +

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2025-68973? +

CVE-2025-68973 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-68973? +

CVE-2025-68973 affects products from gnupg, specifically: gnupg. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-68973? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-41989 6.7

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.

CVE-2025-68972 5.9

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can …

CVE-2026-41990 4.0

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled …

CVE-2025-30258 2.7

In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a …