Message Manipulation Vulnerability in GnuPG 2.4.8 by GnuPG

CVE-2025-68972

What is CVE-2025-68972?

In GnuPG version 2.4.8, a vulnerability exists that allows an adversary to exploit the format of signed messages. By incorporating a form feed character () at the end of a plaintext line, attackers can create a modified version of a signed message. This alteration can lead to successful signature verification, even though the integrity is compromised, as the verification process will return an 'invalid armor' error. This issue arises from the reliance on  as a truncation marker in long plaintext lines, rendering the signature validation process susceptible to manipulation.

References