CVE-2025-67268
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In gpsd before commit dc966aa, a heap-based out-of-bounds write vulnerability exists in the drivers/driver_nmea2000.c file. The hnd_129540 function, handling NMEA2000 PGN 129540 packets, fails to validate the user-supplied satellite count against the skyview array size (184 elements). An attacker can provide a satellite count up to 255, causing a write beyond the array bounds, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Risk Assessment
The risk for the organization includes the possibility of remote Denial of Service (DoS) of the gpsd service and potential arbitrary code execution, which could compromise system integrity and data confidentiality.
Recommendation
Immediately update gpsd to a version containing commit dc966aa or later, which fixes this vulnerability. If an update is not possible, restrict access to the gpsd service to trusted sources only.
Other vulnerabilities in gpsd
See all- CVE-2026-60122High
gpsd up to release-3.27.5 contains a code injection vulnerability in gpsprof, where an attacker controlling GPS input can inject arbitrary OS commands via the SKY.satellites[].used field, which is unsanitized in a gnuplot heredoc.
- CVE-2026-58459High
In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.
- CVE-2025-67269High
In gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`, an unsigned integer underflow exists in the `nextstate()` function in `gpsd/packet.c`. When parsing a NAVCOM packet, the payload length is calculated as `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4, resulting in a very large value and a loop consuming 100% CPU.
Original NVD description (English source)
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS