CVE-2025-68973

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

• CWE-675
• CWE-787

• https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306Product
• https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9Patch
• https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51Patch
• https://gpg.fail/memcpyBroken Link
• https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-iIssue Tracking
• https://news.ycombinator.com/item?id=46403200Issue Tracking
• https://www.openwall.com/lists/oss-security/2025/12/28/5Mailing List
• http://www.openwall.com/lists/oss-security/2025/12/29/11Mailing List, Patch
• https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html
• https://gpg.fail/memcpyBroken Link

Published

Dec 28, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68968Double free vulnerability in the multi-mode input module. Im…7.8
• CVE-2025-68969Multi-thread race condition vulnerability in the thermal man…4.7
• CVE-2025-6897A vulnerability classified as critical was found in D-Link D…9.8
• CVE-2025-68970Permission verification bypass vulnerability in the media li…5.5
• CVE-2025-68971In Forgejo through 13.0.3, the attachment component allows a…6.5
• CVE-2025-68972In GnuPG through 2.4.8, if a signed message has \f at the en…4.7
• CVE-2025-68974Improper Control of Filename for Include/Require Statement i…6.6
• CVE-2025-68975Authorization Bypass Through User-Controlled Key vulnerabili…4.3
• CVE-2025-68976Missing Authorization vulnerability in Eagle-Themes Eagle Bo…5.4
• CVE-2025-68977Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-68978Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-68979Authorization Bypass Through User-Controlled Key vulnerabili…5.3