Out-of-bounds write in GnuPG
Priority HIGH 69CWE-675Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 33 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Partial GnuPG (GnuPG): 2.2.51, 2.4.9Red Hat: 22 advisoriesRed Hat: 33 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA GnuPG (GnuPG) Fixed in 2.2.51, 2.4.9
Red Hat 22 advisories
- RHSA-2026:2568 Released 2026-02-11 · Red Hat rating ImportantRHACS 4.9.3 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
- RHSA-2026:2563 Released 2026-02-11 · Red Hat rating ImportantRed Hat Update Infrastructure 5 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
- RHSA-2026:2485 Released 2026-02-10 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
Show 19 more Red Hat advisories
- RHSA-2026:2350 Released 2026-02-09 · Red Hat rating ImportantRHACS 4.9.3 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +6
- RHSA-2026:1859 Released 2026-02-03 · Red Hat rating ImportantOpenShift Compliance Operator bug fix and enhancement update
- OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-content-rhel8, registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8, registry.redhat.io/compliance/openshift-compliance-openscap-rhel8 +1
- RHSA-2026:1858 Released 2026-02-03 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7 registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:1736 Released 2026-02-02 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:1719 Released 2026-02-02 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) gnupg2-smime-2.3.3-2.el9_0.1
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) gnupg2-2.3.3-2.el9_0.1
- RHSA-2026:1705 Released 2026-02-02 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) gnupg2-smime-2.3.3-2.el9_2.1
- Red Hat Enterprise Linux BaseOS E4S (v.9.2) gnupg2-2.3.3-2.el9_2.1
- RHSA-2026:1677 Released 2026-02-02 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux Server (v. 7 ELS) gnupg2-2.0.22-5.el7_9.1
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) gnupg2-smime-2.0.22-5.el7_9.1
- RHSA-2026:1652 Released 2026-02-02 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2026:1629 Released 2026-02-02 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) gnupg2-smime-2.4.5-2.el10_0.1
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) gnupg2-2.4.5-2.el10_0.1
- RHSA-2026:1517 Released 2026-01-28 · Red Hat rating ImportantRHACS 4.8.8 security and bug fix update
- Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
- RHSA-2026:1468 Released 2026-01-28 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) gnupg2-2.2.9-1.el8_2.1, gnupg2-smime-2.2.9-1.el8_2.1
- RHSA-2026:1229 Released 2026-01-26 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) gnupg2-smime-2.3.3-4.el9_6.1
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) gnupg2-2.3.3-4.el9_6.1
- RHSA-2026:1230 Released 2026-01-26 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) gnupg2-smime-2.3.3-4.el9_4.1
- Red Hat Enterprise Linux BaseOS EUS (v.9.4) gnupg2-2.3.3-4.el9_4.1
- RHSA-2026:1014 Released 2026-01-22 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) gnupg2-2.2.20-2.el8_4.1, gnupg2-smime-2.2.20-2.el8_4.1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) gnupg2-2.2.20-2.el8_4.1, gnupg2-smime-2.2.20-2.el8_4.1
- RHSA-2026:0974 Released 2026-01-22 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) gnupg2-2.2.20-3.el8_6.1, gnupg2-smime-2.2.20-3.el8_6.1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) gnupg2-2.2.20-3.el8_6.1, gnupg2-smime-2.2.20-3.el8_6.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) gnupg2-2.2.20-3.el8_6.1, gnupg2-smime-2.2.20-3.el8_6.1
- RHSA-2026:0935 Released 2026-01-21 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) gnupg2-2.2.20-3.el8_8.1, gnupg2-smime-2.2.20-3.el8_8.1
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) gnupg2-2.2.20-3.el8_8.1, gnupg2-smime-2.2.20-3.el8_8.1
- RHSA-2026:0728 Released 2026-01-15 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux BaseOS (v. 8) gnupg2-2.2.20-4.el8_10, gnupg2-smime-2.2.20-4.el8_10
- RHSA-2026:0719 Released 2026-01-15 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream (v. 9) gnupg2-smime-2.3.3-5.el9_7
- Red Hat Enterprise Linux BaseOS (v. 9) gnupg2-2.3.3-5.el9_7
- RHSA-2026:0697 Released 2026-01-15 · Red Hat rating Importantgnupg2 security update
- Red Hat Enterprise Linux AppStream (v. 10) gnupg2-smime-2.4.5-3.el10_1
- Red Hat Enterprise Linux BaseOS (v. 10) gnupg2-2.4.5-3.el10_1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Compliance Operator 1 | Fixed | RHSA-2026:1859 |
| Red Hat Advanced Cluster Security 4.8 | Fixed | RHSA-2026:1517 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:2350, RHSA-2026:2568 |
| Red Hat Ceph Storage 7 | Fixed | RHSA-2026:1858 |
| Red Hat Ceph Storage 8 | Fixed | RHSA-2026:1652 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:1736 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:0697 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:0719 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2026:1719 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2026:1705 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:1629 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2026:1230 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:1229 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:0697 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:0728 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:0719 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2026:1468 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2026:1014 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2026:0974 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2026:0974 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2026:0935 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2026:1719 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.2) | Fixed | RHSA-2026:1705 |
| Red Hat Enterprise Linux BaseOS EUS (v. 10.0) | Fixed | RHSA-2026:1629 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.4) | Fixed | RHSA-2026:1230 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.6) | Fixed | RHSA-2026:1229 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2026:1014 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2026:0974 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2026:0935 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2026:1677 |
| Red Hat Enterprise Linux Server Optional (v. 7 ELS) | Fixed | RHSA-2026:1677 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2026:2485 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:2563 |
Not affected: 18 products
- Compliance Operator 1
- Red Hat Advanced Cluster Security 4.8
- Red Hat Advanced Cluster Security 4.9
- Red Hat Ceph Storage 7
- Red Hat Ceph Storage 8
- Red Hat Enterprise Linux AppStream EUS (v.9.4)
- Red Hat Enterprise Linux AppStream EUS (v.9.6)
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
- Red Hat Enterprise Linux BaseOS AUS (v.8.4)
- Red Hat Enterprise Linux BaseOS AUS (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.8)
- Red Hat Enterprise Linux BaseOS EUS (v.9.4)
- Red Hat Enterprise Linux BaseOS EUS (v.9.6)
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
- Red Hat Enterprise Linux BaseOS TUS (v.8.6)
- Red Hat Enterprise Linux BaseOS TUS (v.8.8)
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-68973
- 2026-10-03 Alias added: GHSA-pj23-86ww-f72p
- 2026-11-05 Fix available: Compliance Operator 1 · Red Hat
References
Patch 3
Other 5
- https://gpg.fail/memcpy
- https://news.ycombinator.com/item?id=46403200
- https://www.openwall.com/lists/oss-security/2025/12/28/5
- https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306
- https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i
More Gnupg vulnerabilities
- TI-2022-03243 Integer overflow in libksba CVSS 3.1CRITICAL 9.8
- TI-2025-42428 Improper signature verification in GnuPG CVSS 3.1MEDIUM 5.9
- TI-2008-01464 GnuPG (gpg) 1.4.8 and 2.0.8 allows remote attackers to cause a denial of service (crash)… CVSS 2.0HIGH 9.3
- TI-2026-20067 Stack-based buffer overflow in GnuPG CVSS 3.1CRITICAL 9.8
- TI-2018-08614 mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and… CVSS 3.1HIGH 7.5
- TI-2010-02445 Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16… CVSS 3.1HIGH 8.1
Sources
- CVE-2025-68973 · CVE Program
- CVE-2025-68973 · NVD
- FIRST EPSS
- GHSA-pj23-86ww-f72p · GitHub Advisory Database · CC BY 4.0
- CVE-2025-68973 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences