What is the CVSS score of CVE-2025-67268?

CVE-2025-67268 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Gpsd are affected by CVE-2025-67268?

Organizations using gpsd before commit dc966aa face critical risk from CVE-2025-67268, a heap-based buffer overflow vulnerability rated CVSS 9.8.. A patch is available.

Is there a public PoC exploit available for CVE-2025-67268?

Yes, a public proof-of-concept exploit is available for CVE-2025-67268. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-67268?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. If patching is delayed, consider network segmentation to limit exposure.

Gpsd CVE-2025-67268

CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-01-02 cve@mitre.org

RCE Denial Of Service Memory Corruption Heap Overflow Red Hat Gpsd Suse

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 12, 2026 - 15:33 vuln.today

Public exploit code

Patch released

Jan 12, 2026 - 15:33 nvd

Patch available

CVE Published

Jan 02, 2026 - 16:17 nvd

CRITICAL 9.8

DescriptionNVD

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

AnalysisAI

gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.

Technical ContextAI

The hnd_129540 function processes GNSS Satellites in View packets without validating the satellite count against the skyview array size of 184 elements (CWE-122). A crafted NMEA2000 packet with a count exceeding 184 writes beyond the heap buffer, corrupting adjacent memory and enabling attacker-controlled code execution.

RemediationAI

Update gpsd to include commit dc966aa or later. Isolate NMEA2000 networks from general-purpose networks. Monitor gpsd process for crashes indicating exploitation attempts.