Gpsd
CVE-2025-67268
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 (Critical). Network vector, no auth, low complexity. gpsd runs on marine, aviation, and autonomous vehicle systems. PoC and patch available. EPSS 0.14%. GPS daemon compromise can affect navigation accuracy and system integrity. |
| Exploit ScenarioDerived | An attacker on a boat's NMEA2000 network (or spoofing NMEA2000 over IP) sends a crafted PGN 129540 packet with satellite count > 184. The heap overflow in gpsd gives the attacker code execution on the navigation computer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.
Earlier versions of this analysis (1)
gpsd NMEA2000 handler has a heap overflow via unsanitized satellite count, enabling code execution on GPS systems.
RemediationAI
Update gpsd to include commit dc966aa or later. Isolate NMEA2000 networks from general-purpose networks. Monitor gpsd process for crashes indicating exploitation attempts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The hnd_129540 function processes GNSS Satellites in View packets without validating the satellite count against the skyview array size of 184 elements (CWE-122). A crafted NMEA2000 packet with a count exceeding 184 writes beyond the heap buffer, corrupting adjacent memory and enabling attacker-controlled code execution.
Know when Gpsd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Executive ViewAI
Organizations using gpsd before commit dc966aa face critical risk from CVE-2025-67268, a heap-based buffer overflow vulnerability rated CVSS 9.8. Exploitation could allow attackers to corrupt memory, crash the application, or potentially execute arbitrary code. Proof-of-concept code is publicly available, increasing the risk of exploitation. A patch is available and should be applied immediately given the critical severity.
Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to com
An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. Rated high sever
The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and pos
Arbitrary shell command execution in gpsd's gpsprof profiling tool (through release-3.27.5) allows an attacker who contr
OS command injection in gpsd's gpsprof profiling utility (through release-3.27.5) lets an attacker who controls GPS inpu
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB