Bug 2425966 (CVE-2025-68973)

Summary: CVE-2025-68973 GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: crizzo, gtanzill, javiube, jbuscemi, jmitchel, kshier, teagle
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GnuPG. An attacker can provide crafted input to the `armor_filter` function, which incorrectly increments an index variable, leading to an out-of-bounds write. This memory corruption vulnerability may allow for information disclosure and could potentially lead to arbitrary code execution.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-30 07:12:00 UTC
In GnuPG through 2.4.8, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input.

Comment 1 Javier Hernández 2026-01-12 09:53:02 UTC
Hey, are there any plans in fixing cve-2025-68973?

Comment 2 Javier Hernández 2026-01-12 09:58:25 UTC
Oh, I see that the fix has been pushed to Fedora already [1]
I imagine that RHEL will get it anytime soon, right?

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2425718

Comment 3 errata-xmlrpc 2026-01-15 11:21:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:0697 https://access.redhat.com/errata/RHSA-2026:0697

Comment 4 errata-xmlrpc 2026-01-15 17:02:32 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:0719 https://access.redhat.com/errata/RHSA-2026:0719

Comment 5 errata-xmlrpc 2026-01-15 21:24:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:0728 https://access.redhat.com/errata/RHSA-2026:0728

Comment 6 errata-xmlrpc 2026-01-21 19:01:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:0935 https://access.redhat.com/errata/RHSA-2026:0935

Comment 7 errata-xmlrpc 2026-01-22 06:47:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:0974 https://access.redhat.com/errata/RHSA-2026:0974

Comment 8 errata-xmlrpc 2026-01-22 15:44:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:1014 https://access.redhat.com/errata/RHSA-2026:1014