Critical Security Flaw in gnupg2 and gnupg2-smime: Information Disclosure and Arbitrary Code Execution
Summary
ALSA-2026:0719: Important: gnupg2 security update. Affects gnupg2 versions < 2.3.3-5.el9_7. Fixed in 2.3.3-5.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The GNU Privacy Guard (GnuPG or GPG) is a widely used tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. It is essential for ensuring secure communications and data integrity. The recent vulnerability affects versions of gnupg2 and gnupg2-smime, which are integral for users relying on secure data exchange.
Vulnerability Detail
The vulnerability identified as CVE-2025-68973 involves an out-of-bounds write that can lead to information disclosure and potential arbitrary code execution. This flaw arises from improper handling of certain inputs, allowing attackers to exploit the vulnerability and execute malicious code on affected systems. The implications of this vulnerability are severe, as it can compromise sensitive data and system integrity.
How To Fix
Minimum fixed version
2.3.3-5.el9_7
This is the first release that contains the fix.
sudo dnf update gnupg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the affected packages by restricting their use or disabling them until the update is applied. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The vulnerability in gnupg2 and gnupg2-smime poses significant risks to users relying on secure communications. It is crucial to update to the patched version to mitigate these risks and protect sensitive data. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for gnupg2 →
FAQ
CVE-2025-68973 is a vulnerability in gnupg2 and gnupg2-smime that allows for information disclosure and arbitrary code execution due to an out-of-bounds write.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
The risks include potential unauthorized access to sensitive data and the ability for attackers to execute malicious code, which can compromise system integrity.
Yes, you can limit the use of the affected packages or disable them temporarily until the patch is applied.
It is recommended to regularly check for vulnerabilities, especially after updates or changes to your software environment, to ensure ongoing security.
Related vulnerabilities
Recent vulnerabilities recorded for gnupg2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
