Critical Security Flaw in gnupg2 and gnupg2-smime: Information Disclosure and Code Execution Risk
Summary
ALSA-2026:0697: Important: gnupg2 security update. Affects gnupg2 versions < 2.4.5-3.el10_1. Fixed in 2.4.5-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GNU Privacy Guard (GnuPG or GPG) is a widely-used tool for encrypting data and creating digital signatures, adhering to OpenPGP and S/MIME standards. It is essential for ensuring secure communications and protecting sensitive information. The recent vulnerability affects versions of gnupg2 and gnupg2-smime, which are integral components for users relying on GnuPG for secure data handling.
Vulnerability Detail
The vulnerability identified as CVE-2025-68973 involves an out-of-bounds write that could lead to information disclosure and potential arbitrary code execution. This flaw arises from improper handling of memory, allowing attackers to exploit the vulnerability to execute malicious code or access sensitive data, posing significant risks to users and systems relying on GnuPG for security.
How To Fix
Minimum fixed version
2.4.5-3.el10_1
This is the first release that contains the fix.
sudo dnf update gnupg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of gnupg2 and gnupg2-smime until the update is applied. Avoid processing untrusted data with these tools to mitigate the risk of exploitation.
Conclusion
The vulnerability in gnupg2 and gnupg2-smime poses significant risks due to potential information disclosure and arbitrary code execution. Users are urged to update their packages promptly to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for gnupg2 →
FAQ
CVE-2025-68973 is a security vulnerability in gnupg2 and gnupg2-smime that allows for information disclosure and potential arbitrary code execution due to an out-of-bounds write.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring a signup.
The risks include unauthorized access to sensitive information and the potential for attackers to execute arbitrary code on affected systems, which can lead to data breaches or system compromise.
Yes, a patch is available. Users should update to version 2.4.5-3.el10_1 or later for both gnupg2 and gnupg2-smime to mitigate the vulnerability.
If immediate updating is not possible, limit the use of the affected packages and avoid processing untrusted data until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for gnupg2.
