CVE-2025-68973

HIGH

GnuPG < 2.4.9 - Out-of-Bounds Write via Armor Filter Index Mismanagement

Title source: llm
STIX 2.1

Description

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

References (9)

Core 9

Scores

CVSS v3 7.8
EPSS 0.0013
EPSS Percentile 2.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-675 CWE-787
Status published
Products (3)
GnuPG/GnuPG < 2.2.51
gnupg/gnupg < 2.4.8
GnuPG/GnuPG 2.3.0 - 2.4.9
Published Dec 28, 2025
Tracked Since Feb 18, 2026