CVE-2025-67897: 
Rust vulnerability analysis and mitigation

CVE-2025-67897 is a denial-of-service vulnerability in Sequoia PGP's aes_key_unwrap function caused by a subtraction overflow (signed-to-unsigned conversion error) when processing a ciphertext that is too short. It affects the sequoia-openpgp Rust crate in all versions before 2.1.0. A remote attacker can exploit this by sending a victim a crafted encrypted message containing a malformed PKESK or SKESK packet, causing the application to panic and crash. The vulnerability was published on December 14, 2025, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-195 (Signed to Unsigned Conversion Error): the aes_key_unwrap function performs a subtraction on a length value without first validating that the ciphertext meets the minimum required length, resulting in an integer underflow that triggers a Rust panic. The attack vector is network-based, requiring user interaction (the victim must process the crafted message), with high attack complexity. An attacker crafts a PKESK (Public-Key Encrypted Session Key) or SKESK (Symmetric-Key Encrypted Session Key) OpenPGP packet with an abnormally short ciphertext payload and delivers it to a target using a Sequoia-based application. The fix is documented in the Sequoia commit b59886e5e7bdf7169ed330f309a6633d131776e5 and the associated NEWS file (GitHub Advisory, RustSec Advisory).

Successful exploitation causes the affected Sequoia-based application to panic and crash, resulting in a denial-of-service condition. There is no impact on confidentiality or data integrity — only availability is affected. Any application that uses the sequoia-openpgp crate (versions < 2.1.0) to process incoming encrypted OpenPGP messages is at risk, including email clients, file encryption tools, and other PGP-enabled software built on Sequoia (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.124% (0.166% per GitHub Advisory), placing it in the 37th percentile for exploitation probability within 30 days. Exploitation requires the attacker to deliver a crafted message to a victim who then processes it with a vulnerable Sequoia-based application, adding a meaningful barrier to mass exploitation.

1. Identify target: Determine that the target uses a Sequoia PGP-based application (e.g., an email client or encryption tool using sequoia-openpgp < 2.1.0) to process incoming OpenPGP-encrypted messages.
2. Craft malicious packet: Construct an OpenPGP message containing a PKESK or SKESK packet with a ciphertext payload shorter than the minimum length expected by the aes_key_unwrap function.
3. Deliver the message: Send the crafted encrypted message to the victim via email or another channel through which the target application will automatically or manually attempt to decrypt it.
4. Trigger panic: When the victim's application processes the malformed packet, aes_key_unwrap performs an unchecked subtraction on the ciphertext length, causing an integer underflow and a Rust panic, crashing the application (GitHub Advisory).

• Logs: Unexpected Rust panic messages in application logs referencing aes_key_unwrap or the sequoia-openpgp crate; stack traces showing an arithmetic overflow or subtraction underflow in OpenPGP key unwrapping code.
• Process: Sudden, repeated crashes of a Sequoia-based PGP application (e.g., email client or encryption daemon) without a clear user-initiated cause.
• Network: Receipt of OpenPGP-encrypted messages with unusually small or malformed PKESK/SKESK packet payloads from unexpected or unknown senders.

The primary remediation is to upgrade the sequoia-openpgp Rust crate to version 2.1.0 or later, which includes a fix that validates ciphertext length before performing the subtraction in aes_key_unwrap (GitHub Advisory, RustSec Advisory). As a temporary workaround, operators can implement input validation or filtering at the application or gateway level to reject OpenPGP messages with abnormally short or malformed PKESK/SKESK packets before they reach the vulnerable function. Limiting exposure of Sequoia-based services to untrusted networks and monitoring for unexpected application crashes can reduce risk until patching is complete.

The vulnerability was tracked by Debian (bug #1122582) and addressed in downstream distributions including Fedora and Debian, with Debian publishing a security update in January 2026 (Debian News). The RustSec advisory database published RUSTSEC-2025-0136 to alert the Rust ecosystem (RustSec Advisory). The JohnnyCanEncrypt project, which depends on Sequoia, released version 0.18.0 in part to address this vulnerability. Community reaction has been measured, consistent with the moderate severity and lack of active exploitation.