CVE-2025-68973
EUVD-2025-20551928.12.2025, 17:16
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gnupg | gnupg | 𝑥 ≤ 2.4.8 |
𝑥
= Vulnerable software versions
Debian Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| dirmngr |
| ||||||||||||||||||||
| gpg2 |
| ||||||||||||||||||||
| gpg2-lang |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gnupg2 |
| ||||||||||||||||||
| gnupg2-smime |
|
Common Weakness Enumeration
- CWE-675 - Multiple Operations on Resource in Single-Operation ContextThe product performs the same operation on a resource two or more times, when the operation should only be applied once.
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.
References