CVE-2025-68973

Katalog CVE

CVSS 7.0 · High EPSS 0,16%

Kerentanan Multiple Operations on Resource in Single-Operation Context pada gnupg. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Rincian

Terbit di NVD

28 Desember 2025

Terakhir diubah

13 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-675: Multiple Operations on Resource in Single-Operation Context
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 4,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9 patch
• https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51 patch
• http://www.openwall.com/lists/oss-security/2025/12/29/11 mailing list · patch
• https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306 product
• https://gpg.fail/memcpy broken link
• https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i issue tracking
• https://news.ycombinator.com/item?id=46403200 issue tracking
• https://www.openwall.com/lists/oss-security/2025/12/28/5 mailing list
• https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html