CVE-2025-67269
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`, an unsigned integer underflow exists in the `nextstate()` function in `gpsd/packet.c`. When parsing a NAVCOM packet, the payload length is calculated as `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4, resulting in a very large value and a loop consuming 100% CPU.
Risk Assessment
An attacker can send a crafted NAVCOM packet, causing 100% CPU utilization and a Denial of Service (DoS), which disrupts the gpsd server and applications relying on GPS data.
Recommendation
Immediately update gpsd to a version containing commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7` or later. If updating is not possible, restrict access to the gpsd server to trusted sources only.
Other vulnerabilities in gpsd
See all- CVE-2025-67268Critical
In gpsd before commit dc966aa, a heap-based out-of-bounds write vulnerability exists in the drivers/driver_nmea2000.c file. The hnd_129540 function, handling NMEA2000 PGN 129540 packets, fails to validate the user-supplied satellite count against the skyview array size (184 elements). An attacker can provide a satellite count up to 255, causing a write beyond the array bounds, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
- CVE-2026-60122High
gpsd up to release-3.27.5 contains a code injection vulnerability in gpsprof, where an attacker controlling GPS input can inject arbitrary OS commands via the SKY.satellites[].used field, which is unsanitized in a gnuplot heredoc.
- CVE-2026-58459High
In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.
Original NVD description (English source)
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.