{"id":"CVE-2025-67268","aliases":["ALSA-2026:0770","ALSA-2026:0771","CLSA-2026-1769424492","CLSA-2026-1769593159","DEBIAN-CVE-2025-67268","DLA-4441-1","EUVD-2026-0661","GHSA-mp8p-xhgf-rpjv","MGASA-2026-0028","OESA-2026-3033","OESA-2026-3034","RHSA-2026:0770","RHSA-2026:0771","RHSA-2026:1621","RLSA-2026:0770","RLSA-2026:0771","UBUNTU-CVE-2025-67268","USN-7948-1","openSUSE-SU-2026:10008-1"],"status":"published","title":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers...","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00791,"percentile":0.56734,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-1285"],"published":"2026-01-02T00:00:00Z","modified":"2026-11-06T01:21:34Z","fixes":[{"ecosystem":"Debian:12","package":"gpsd","fixed_in":["3.22-4.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gpsd","fixed_in":["3.25-5+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gpsd","fixed_in":["3.27.5-0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-clients","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-clients-debuginfo","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-debuginfo","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-debugsource","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-gpsd","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-gpsd-debuginfo","fixed_in":["1:3.25-17.el10_0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"gpsd","fixed_in":["3.22-4ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"gpsd","fixed_in":["3.25-3ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"gpsd","fixed_in":["3.25-5ubuntu1.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"gpsd","fixed_in":["3.27-1.1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"gpsd-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gpsd-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"gpsd-minimal-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gpsd-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-4.el9_6.2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"gpsd-minimal-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-4.el9_6.2.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gpsd-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-1.el9.3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"gpsd-minimal-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-1.el9.3.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-4.1+deb12u1"}]}],"versions":["3.22-4.1"]},{"source":"osv","ecosystem":"Debian:13","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-5+deb13u1"}]}],"versions":["3.25-5"]},{"source":"osv","ecosystem":"Debian:14","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.5-0.1"}]}],"versions":["3.25-5","3.26.1-1","3.27-1","3.27-1.1"]},{"source":"osv","ecosystem":"Debian:11","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-4+deb11u1"}]}],"versions":["3.22-4"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-3.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-3.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gpsd-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gpsd-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gpsd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"gpsd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"python3-gpsd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gpsd-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gpsd-minimal-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gpsd-minimal-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gpsd-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"gpsd-minimal-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"gpsd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"python3-gpsd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.25-17.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el10_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"gpsd-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.1-1.el9_7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11-3","3.15-2","3.15-2build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16-4","3.17-3","3.17-5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.17-7","3.19-3","3.20-1","3.20-3","3.20-4","3.20-4build1","3.20-5ubuntu1","3.20-6","3.20-8","3.20-8ubuntu0.1","3.20-8ubuntu0.2","3.20-8ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-4ubuntu2.1"}]}],"versions":["3.22-4","3.22-4ubuntu1","3.22-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-3ubuntu3.2"}]}],"versions":["3.25-2ubuntu2","3.25-3ubuntu2","3.25-3ubuntu3","3.25-3ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-5ubuntu1.25.10.1"}]}],"versions":["3.25-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27-1.1ubuntu1"}]}],"versions":["3.25-5ubuntu1","3.27-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22-4ubuntu2.1"}]}],"versions":["3.22-4","3.22-4ubuntu1","3.22-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-3ubuntu3.2"}]}],"versions":["3.25-2ubuntu2","3.25-3ubuntu2","3.25-3ubuntu3","3.25-3ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.25-5ubuntu1.25.10.1"}]}],"versions":["3.25-5ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gpsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"gpsd_project","product":"gpsd"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4","tags":["Patch","fix","article"]},{"url":"https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c","tags":["Product","web","article"]},{"url":"https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md","tags":["Exploit","Third Party Advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-67268","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426835","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67268.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1621","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0770","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:0771","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67268","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mp8p-xhgf-rpjv"},{"url":"https://access.redhat.com/security/cve/CVE-2025-67269","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426810","tags":["report"]},{"url":"https://bugzilla.redhat.com/2426835","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-0770.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-0771.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1769424492.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1769593159.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67268.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-67268","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0028.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34959","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7948-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67269","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3034","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426810","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0770.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67268","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67269","tags":["advisory"]},{"url":"https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67269/README.md","tags":["article"]},{"url":"https://gitlab.com/gpsd/gpsd","tags":["article"]},{"url":"https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0771.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1621.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0770","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:0771","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-67268","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-67269","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67269","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-67268","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-07-15T01:25:11.94Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122","CWE-1285"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2026-0661","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-07-15T01:25:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:54.255702Z"}],"ghsa":[{"id":"GHSA-mp8p-xhgf-rpjv","title":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers...","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T18:30:31Z","modified":"2026-06-30T03:35:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-1285"],"updated_at":"2026-11-02T15:09:04.017394Z"}],"nvd":[{"id":"CVE-2025-67268","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T16:17:00.99Z","modified":"2026-11-04T22:10:00.21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122","CWE-1285"],"updated_at":"2026-11-04T23:43:38.567042Z"}],"osv":[{"id":"CVE-2025-67268","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T00:00:00Z","modified":"2026-11-06T01:21:34.167150199Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T02:03:53.554046Z"},{"id":"DEBIAN-CVE-2025-67268","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T16:17:00.99Z","modified":"2026-11-05T09:47:27.827249553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"OESA-2026-3033","title":"gpsd security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.\r\n\r\nSecurity Fix(es):\n\ngpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.(CVE-2025-67268)\n\nAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer-\u0026gt;length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer-\u0026gt;length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.(CVE-2025-67269)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:19.02820443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3034","title":"gpsd security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.\r\n\r\nSecurity Fix(es):\n\ngpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.(CVE-2025-67268)\n\nAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer-\u0026gt;length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer-\u0026gt;length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.(CVE-2025-67269)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:19.661735328Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:0770","title":"Red Hat Security Advisory: gpsd security update","status":"published","published":"2026-01-20T10:05:30Z","modified":"2026-06-30T10:33:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:0771","title":"Red Hat Security Advisory: gpsd-minimal security update","status":"published","published":"2026-01-20T10:05:30Z","modified":"2026-06-30T10:33:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:1621","title":"Red Hat Security Advisory: gpsd security update","status":"published","published":"2026-02-02T10:07:24Z","modified":"2026-06-30T10:37:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RLSA-2026:0770","title":"Important: gpsd security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.\n\nSecurity Fix(es):\n\n* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)\n\n* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-21T09:06:31.007549Z","modified":"2026-01-21T09:30:00.76593Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:0771","title":"Important: gpsd-minimal security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  The Rocky Enterprise Software Foundation support for this package is limited. See https://access.redhat.com/support/policy/gpsd-support for more details.\n\nSecurity Fix(es):\n\n* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)\n\n* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-20T09:05:33.258641Z","modified":"2026-01-20T09:30:48.677281Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-67268","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.","status":"published","published":"2026-01-02T16:17:00Z","modified":"2026-06-30T18:15:52.062438412Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"ALSA-2026:0770","title":"Important: gpsd security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.  \n\nSecurity Fix(es):  \n\n  * gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)\n  * gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-10-29T11:58:17.899751Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:0771","title":"Important: gpsd-minimal security update","description":"gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited. See \u003chttps://access.AlmaLinux.com/support/policy/gpsd-support\u003e for more details.  \n\nSecurity Fix(es):  \n\n  * gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)\n  * gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-10-29T11:32:30.224016379Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1769424492","title":"gpsd-minimal: Fix of 2 CVEs","description":"- CVE-2025-67268: fix heap-based buffer overrun in NMEA2000 GNSS satellite handling\n- CVE-2025-67269: fix integer underflow in NAVCOM packet parsing to prevent excessive\n   payload length and CPU-exhaustion","status":"published","published":"2026-01-26T10:48:15Z","modified":"2026-06-01T00:32:37.225385473Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1769593159","title":"gpsd-minimal: Fix of 2 CVEs","description":"- CVE-2025-67268: fix heap-based out-of-bounds write in NMEA2000 Driver\n- CVE-2025-67269: fix integer underflow leading to DoS in NAVCOM packet parsing","status":"published","published":"2026-01-28T09:39:23Z","modified":"2026-06-01T00:31:40.242070292Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"DLA-4441-1","title":"gpsd - security update","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-01-19T01:15:00.017718Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2026-0028","title":"Updated gpsd packages fix security vulnerabilities","description":"gpsd before commit dc966aa contains a heap-based out-of-bounds write\nvulnerability in the drivers/driver_nmea2000.c file. The hnd_129540\nfunction, which handles NMEA2000 PGN 129540 (GNSS Satellites in View)\npackets, fails to validate the user-supplied satellite count against the\nsize of the skyview array (184 elements). This allows an attacker to\nwrite beyond the bounds of the array by providing a satellite count up\nto 255, leading to memory corruption, Denial of Service (DoS), and\npotentially arbitrary code execution. (CVE-2025-67268)\nAn integer underflow vulnerability exists in the `nextstate()` function\nin `gpsd/packet.c` of gpsd versions prior to commit\n`ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM\npacket, the payload length is calculated using `lexer-\u003elength =\n(size_t)c - 4` without checking if the input byte `c` is less than 4.\nThis results in an unsigned integer underflow, setting `lexer-\u003elength`\nto a very large value (near `SIZE_MAX`). The parser then enters a loop\nattempting to consume this massive number of bytes, causing 100% CPU\nutilization and a Denial of Service (DoS) condition. (CVE-2025-67269)\n","status":"published","published":"2026-01-30T00:39:37Z","modified":"2026-04-16T04:40:53.052516002Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10008-1","title":"gpsd-3.27.3-1.1 on GA media","description":"These are all security issues fixed in the gpsd-3.27.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-06T00:00:00Z","modified":"2026-03-23T04:54:20.098643Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"USN-7948-1","title":"gpsd vulnerabilities","description":"It was discovered that GPSd incorrectly handled processing NMEA2000\npackets. An attacker could use this issue to cause GPSd to crash, resulting\nin a denial of service, or possibly execute arbitrary code.\n(CVE-2025-67268)\n\nIt was discovered that GPSd incorrectly handled processing NAVCOM packets.\nAn attacker could possibly use this issue to cause GPSd to consume\nresources, resulting in a denial of service. (CVE-2025-67269)","status":"published","published":"2026-01-08T14:34:17Z","modified":"2026-06-30T18:15:13.566165009Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}