Read the docs
TI-2025-41174 Aliases CVE-2025-67268GHSA-mp8p-xhgf-rpjv

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the…

Priority MEDIUM 50CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00791 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:*before 3.27.1VulnerableGpsd Project
  • cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:* Versions before 3.27.1 Vulnerable ·Gpsd Project

Remediation

Red Hat 3 advisories

  • RHSA-2026:1621 Released 2026-02-02 · Red Hat rating Important
    gpsd security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) gpsd-1:3.25-17.el10_0.1, gpsd-clients-1:3.25-17.el10_0.1, python3-gpsd-1:3.25-17.el10_0.1
  • RHSA-2026:0771 Released 2026-01-19 · Red Hat rating Important
    gpsd-minimal security update
    • Red Hat Enterprise Linux AppStream (v. 9) gpsd-minimal-1:3.26.1-1.el9_7.1, gpsd-minimal-clients-1:3.26.1-1.el9_7.1
  • RHSA-2026:0770 Released 2026-01-19 · Red Hat rating Important
    gpsd security update
    • Red Hat Enterprise Linux AppStream (v. 10) gpsd-1:3.26.1-1.el10_1.1, gpsd-clients-1:3.26.1-1.el10_1.1, python3-gpsd-1:3.26.1-1.el10_1.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0770
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0771
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:1621

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67268
  2. 2026-10-03 Alias added: GHSA-mp8p-xhgf-rpjv

References

Exploit 1

Patch 1

Other 1

  • TI-2026-42067 gpsd gpsprof Command Injection via gnuplot plot title subtype field CVSS 4.0HIGH 8.4
  • TI-2018-12768 Stack-based buffer overflow in ICS-CERT gpsd and microjson CVSS 3.1HIGH 8.8
  • TI-2025-41175 An integer underflow vulnerability exists in the `nextstate()` function in… CVSS 3.1HIGH 7.5
  • TI-2023-23356 Integer underflow in GPSd CVSS 3.1HIGH 7.5
  • TI-2013-01809 The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences