GnuPG: Arbitrary Code Execution — GLSA 202512-01

{
  "id": "d6c3b26c8a7ce068f9d39cbc01f23441efaefc8a9c8c005f36bcbe66ee975b2a",
  "url": "https://security.gentoo.org/glsa/202512-01",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "GnuPG: Arbitrary Code Execution — GLSA 202512-01",
    "summary": "A vulnerability in GnuPG's armor parser could allow a remote attacker to execute arbitrary commands when a user or automated system processes a crafted signature file. Users should upgrade to version 2.5.14 or later.",
    "evidence": "A vulnerability has been discovered in GnuPG's armor parser. Impact A remote attacker could entice a user or automated system to process a specially crafted signature file, possibly resulting in execution of arbitrary commands with the privileges of the process.",
    "products": [
      {
        "name": {
          "value": "app-crypt/gnupg",
          "evidence": "Package app-crypt/gnupg on all architectures"
        },
        "prerequisites": [
          {
            "value": "process a specially crafted signature file",
            "evidence": "A remote attacker could entice a user or automated system to process a specially crafted signature file"
          }
        ],
        "fixed_versions": [
          {
            "value": ">= 2.5.14",
            "evidence": "Unaffected versions >= 2.5.14"
          }
        ],
        "affected_versions": [
          {
            "value": "< 2.5.14",
            "evidence": "Affected versions < 2.5.14"
          }
        ]
      }
    ],
    "severity": "high",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": "1 Severity high"
  },
  "source_id": "official-gentoo-glsa",
  "document_id": 23684,
  "published_at": "2025-12-27T00:00:00+00:00"
}