CVE-2025-67268
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Analysis
gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.
Technical Context
The hnd_129540 function processes GNSS Satellites in View packets without validating the satellite count against the skyview array size of 184 elements (CWE-122). A crafted NMEA2000 packet with a count exceeding 184 writes beyond the heap buffer, corrupting adjacent memory and enabling attacker-controlled code execution.
Affected Products
gpsd before commit dc966aa
Remediation
Update gpsd to include commit dc966aa or later. Isolate NMEA2000 networks from general-purpose networks. Monitor gpsd process for crashes indicating exploitation attempts.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today