CVE-2026-58459
HighCVSS 7.8Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.
Risk Assessment
The risk is remote arbitrary shell command execution by an attacker who controls GPS device data (e.g., via a rogue device or intercepted communication). This could lead to full system compromise for the user running gpsprof with gnuplot.
Recommendation
Immediately update gpsd to a version containing commit 4c06658 or later. If updating is not possible, avoid using gpsprof with untrusted GPS data sources.
Other vulnerabilities in gpsd
See all- CVE-2025-67268Critical
In gpsd before commit dc966aa, a heap-based out-of-bounds write vulnerability exists in the drivers/driver_nmea2000.c file. The hnd_129540 function, handling NMEA2000 PGN 129540 packets, fails to validate the user-supplied satellite count against the skyview array size (184 elements). An attacker can provide a satellite count up to 255, causing a write beyond the array bounds, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
- CVE-2026-60122High
gpsd up to release-3.27.5 contains a code injection vulnerability in gpsprof, where an attacker controlling GPS input can inject arbitrary OS commands via the SKY.satellites[].used field, which is unsanitized in a gnuplot heredoc.
- CVE-2025-67269High
In gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`, an unsigned integer underflow exists in the `nextstate()` function in `gpsd/packet.c`. When parsing a NAVCOM packet, the payload length is calculated as `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4, resulting in a very large value and a loop consuming 100% CPU.
Original NVD description (English source)
gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.