CVE-2025-67268 Details
Description
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
A heap-based out-of-bounds write vulnerability exists in gpsd versions prior to 3.27.1, specifically within the NMEA2000 driver. The issue arises in the 'hnd_129540' function, which processes NMEA2000 PGN 129540 (GNSS Satellites in View) packets. The function fails to properly validate the user-supplied satellite count against the fixed size of the skyview array, which can lead to memory corruption. An attacker can exploit this vulnerability by sending a packet with a satellite count of up to 255, causing the application to write beyond the array's bounds. This exploitation can result in a denial-of-service condition, memory corruption, and potentially allow for arbitrary code execution.
Users can update to gpsd version 3.27.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| gpsd project gpsd | < 3.27.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 12, 2026 | Initial Analysis | [email protected] |
| Jan 6, 2026 | CVE Modified | CISA-ADP |
| Jan 2, 2026 | New CVE Received | [email protected] |