This weekend GPG developer and habitual liar Werner Koch announced a vulnerability that consumes unsanitized input allowing control characters to be called when file names are displayed (archived). The announcement and offered mitigations in conjunction with Koch's history suggest an intentional vulnerability in the software being "burned".