There is 1 open security issue in trixie.
1 issue left for the package maintainer to handle:
- CVE-2025-68972:
(needs triaging)
In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
You can find information about how to handle this issue in the security team's documentation.
2 issues that should be fixed with the next stable update:
- CVE-2026-24882:
In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.
- CVE-2026-57062:
CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/gnupg2.png){kind=link}