---
id: CVE-2025-68973
title: >-
  In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an
  index variable where one is intended, leading to an out-of-bounds write for
  crafted input
summary: >-
  In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an
  index variable where one is intended, leading to an out-of-bounds write for
  crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-675
  - CWE-787
vendor: gnupg
product: gnupg
affected:
  - gnupg <= 2.4.8
published: '2025-12-28'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68973'
references:
  - url: >-
      https://github.com/gpg/gnupg/blob/ff30683418695f5d2cc9e6cf8c9418e09378ebe4/g10/armor.c#L1305-L1306
    label: cve@mitre.org
  - url: >-
      https://github.com/gpg/gnupg/commit/115d138ba599328005c5321c0ef9f00355838ca9
    label: cve@mitre.org
  - url: 'https://github.com/gpg/gnupg/compare/gnupg-2.2.50...gnupg-2.2.51'
    label: cve@mitre.org
  - url: 'https://gpg.fail/memcpy'
    label: cve@mitre.org
  - url: >-
      https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i
    label: cve@mitre.org
  - url: 'https://news.ycombinator.com/item?id=46403200'
    label: cve@mitre.org
  - url: 'https://www.openwall.com/lists/oss-security/2025/12/28/5'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/12/29/11'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2026/01/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://gpg.fail/memcpy'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00152
epssPercentile: 0.03821
ingestedAt: '2026-10-13T09:20:23.167Z'
---

## Overview

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

## Affected

- `gnupg <= 2.4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.