In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Exploitation of this vulnerability requires an attacker to obtain a legitimate signature on crafted content and trick users into trusting unsigned material displayed alongside signed content without properly verifying signed contents. There is no fix available from the GnuPG project. Users are advised to mitigate this issue by avoiding using cleartext signatures and always using “gpg —output“ to verify what content was actually signed.