CVE-2025-68972
Publication date 27 December 2025
Last updated 31 March 2026
Ubuntu priority
Description
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gnupg2 | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Notes
mdeslaur
Per GnuPG developers, this is not a security issue, see: https://gnupg.org/blog/20251226-cleartext-signatures.html https://lists.gnupg.org/pipermail/gnupg-devel/2026-January/036164.html https://lists.gnupg.org/pipermail/gnupg-devel/2026-January/036154.html Marking as not-affected in Ubuntu.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.9 · Medium
|
| Attack vector | Local |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | None |
| Integrity impact | High |
| Availability impact | None |
| Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N |