In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

🗓️ 29 Dec 2025 09:01:18Reported by MicrosoftType

In GnuPG up to 2.4.8, a form feed at end of a line lets attackers append text after signed content.

Reporter	Title	Published	Views	Family All 41
AlpineLinux	CVE-2025-68972	27 Dec 202522:52	–	alpinelinux
BDU FSTEC	The vulnerability of GnuPG’s information encryption and digital signatures software, related to errors in verifying cryptographic signatures, allows attackers to circumvent existing security mechanisms.	14 Apr 202600:00	–	bdu_fstec
CBLMariner	CVE-2025-68972 affecting package gnupg2 for versions less than 2.4.9-1	12 Jan 202621:27	–	cbl_mariner
Circl	CVE-2025-68972	28 Dec 202502:27	–	circl
CNNVD	GNUPG 数据伪造问题漏洞	27 Dec 202500:00	–	cnnvd
CVE	CVE-2025-68972	27 Dec 202522:52	–	cve
Cvelist	CVE-2025-68972	27 Dec 202522:52	–	cvelist
Debian CVE	CVE-2025-68972	27 Dec 202522:52	–	debiancve
EUVD	EUVD-2025-205487	28 Dec 202500:30	–	euvd
Fedora	[SECURITY] Fedora 42 Update: gnupg2-2.4.9-1.fc42	6 Jan 202600:54	–	fedora