There are 2 open security issues in trixie.
2 issues left for the package maintainer to handle:
- CVE-2025-68972:
(needs triaging)
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
- CVE-2026-24882:
(needs triaging)
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
You can find information about how to handle these issues in the security team's documentation.
1 issue that should be fixed with the next stable update:
- CVE-2026-57062:
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/gnupg2.png){kind=link}