In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
References
| Link | Resource |
|---|---|
| https://gpg.fail/formfeed | Product |
| https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i | Product |
| https://news.ycombinator.com/item?id=46404339 | Issue Tracking |
| https://gpg.fail/formfeed | Product |
Configurations
History
09 Jan 2026, 20:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gnupg gnupg
Gnupg |
|
| CPE | cpe:2.3:a:gnupg:gnupg:*:*:*:*:-:*:*:* | |
| References | () https://gpg.fail/formfeed - Product | |
| References | () https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i - Product | |
| References | () https://news.ycombinator.com/item?id=46404339 - Issue Tracking |
02 Jan 2026, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gpg.fail/formfeed - |
27 Dec 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-27 23:15
Updated : 2026-01-09 20:08
NVD link : CVE-2025-68972
Mitre link : CVE-2025-68972
CVE.ORG link : CVE-2025-68972
JSON object : View
Products Affected
gnupg
- gnupg
CWE
CWE-347
Improper Verification of Cryptographic Signature