CVE-2025-68972: In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

CSIRTS triage

What: A signed message with a form-feed character at the end of a plaintext line can be modified to append unsigned text while retaining a valid signature verification.
Who is affected: All users of GnuPG through version 2.4.8 who rely on signature verification to authenticate message content.
Urgency: Medium priority; signature bypass undermines message authentication but requires specific message formatting.
Action: Upgrade GnuPG to version 2.4.9 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GnuPG

Get an email when a new GnuPG advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-689720.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2025-68972	coverage & exploitation status	NVD · CVE.org