Memory Corruption in ASCII-Armor Parsing
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• gniibe
	Nov 4 2025, 6:56 AM

Description

armor_filter has a bug.
If control == IOBUFCTRL_UNDERFLOW && afx->inp_bypass is true, then *ret_len is greater than the requested size.

Reported-by: 49016 and Liam (two-heart)
CVE-id: CVE-2025-68973

rG GnuPG
	rG1e929abd20fa gpg: Fix possible memory corruption in the armor parser.
	rG115d138ba599 gpg: Fix possible memory corruption in the armor parser.
	rG4ecc5122f20e gpg: Fix possible memory corruption in the armor parser.

		Status	Assigned	Task
		Testing	None	T7900 Cleartext Signature Forgery in GnuPG
		Resolved	• werner	T7906 Memory Corruption in ASCII-Armor Parsing

• gniibe mentioned this in Unknown Object (Maniphest Task).Nov 10 2025, 2:51 AM

• werner changed the task status from Open to Testing.Nov 19 2025, 5:37 PM

• werner triaged this task as Normal priority.

• werner shifted this object from the Restricted Space space to the S1 Public space.

• werner changed the visibility from "g10code (Project)" to "Public (No Login Required)".

• werner changed the edit policy from "g10code (Project)" to "Contributor (Project)".

• werner removed a project: g10code.

Also fixed in the other active branches.