The OpenPGP protocol allows to include the file name of the original input file into a signed or encrypted message. During decryption and verification the GPG tool can display a notice with that file name. Since this displayed file name is not sanitized and as such may include line feeds or other control characters, this can be used to inject control messages.

These status messages are parsed by programs to get information from GPG about the validity of a signature and other parameters. By using a made up file name in the message it is possible to fake status messages. Using this technique it is possible to fake the verification of a signed mail.

This vulnerability is not limited to e-mail security, since GnuPG is also used to secure backups, software updates in distributions, and source code in version control systems like Git.