CVE Feed

    Dashboard / CVE / CVE-2025-67268

    CVE-2025-67268

    gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

    Published:Jan 2, 2026
    Last Modified:Jan 12, 2026
    EPS:Jan 2, 2026
    EPSS Score:0.00097
    CVSS Score:9.8

    Affected Products

    Vendor
    Gpsd Project
    Product
    Gpsd

    Exploits

    https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-60122 (CVSS 8.5) — gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof u…
    CVE-2026-58459 (CVSS 8.4) — gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof th…
    CVE-2025-67269 (CVSS 7.5) — An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions pr…
    CVE-2023-43628 (CVSS 5.9) — An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A spec…
    CVE-2018-17937 (CVSS 8.8) — gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buff…
    CVE-2013-2038 (CVSS 4.3) — The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon terminatio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High