CVE-2025-67268
Critical · 9.8CVSS
9.8
EPSS
0.8%
Published
Jan 2, 2026
CISA due date
—
The record
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | gpsd | 0 | 1:3.26.1-1.el10_1.1 |
| AlmaLinux:10 | gpsd-clients | 0 | 1:3.26.1-1.el10_1.1 |
| AlmaLinux:10 | python3-gpsd | 0 | 1:3.26.1-1.el10_1.1 |
| AlmaLinux:9 | gpsd-minimal | 0 | 1:3.26.1-1.el9_7.1 |
| AlmaLinux:9 | gpsd-minimal-clients | 0 | 1:3.26.1-1.el9_7.1 |
| Mageia:9 | gpsd | 0 | 3.25-1.1.mga9 |
| openSUSE:Tumbleweed | gpsd | 0 | 3.27.3-1.1 |