Which versions of gpsd are affected by CVE-2026-58459?

gpsd's gpsprof tool (through version 3.27.5) enables command execution through specially crafted GPS device data, creating remote code execution risk for organizations that process GPS signals or…. A patch is available.

How to fix or mitigate CVE-2026-58459?

Within 24 hours: Identify and inventory all systems running gpsd release-3.27.5 and earlier. Within 7 days: Apply vendor patch (available per vendor advisory); validate on non-production systems first. Within 30 days: Verify patch deployment across all affected infrastructure and confirm through vulnerability scanning.

gpsd CVE-2026-58459

Q: What is the CVSS score of CVE-2026-58459?

CVE-2026-58459 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-42622 HIGH

OS Command Injection (CWE-78)

2026-07-09 VulnCheck

GHSA-2hhc-4hqc-4mg8

Command Injection Red Hat Gpsd Suse Ntpsec

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Injected subtype data is processed locally and code runs only when the victim actively renders the plot (UI:R, AV:L); no auth needed (PR:N) and full code execution yields C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:05 vuln.today

DescriptionCVE.org

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnuplot program via a set title statement with only double-quote characters escaped, enabling arbitrary shell command execution as the user running gnuplot when the victim renders the generated plot through the gpsprof and gnuplot workflow.

AnalysisAI

Arbitrary shell command execution in gpsd's gpsprof profiling tool (through release-3.27.5) allows an attacker who controls a GPS device's subtype value to run commands as the user rendering the plot. The subtype string - taken from a DEVICES JSON log entry or an NMEA PGRMT sentence - is embedded into a generated gnuplot program's set title statement with only double quotes escaped, so backtick payloads execute when the victim renders the plot via the gpsprof/gnuplot workflow. This was reported by VulnCheck; a vendor fix is available (fixed at commit 4c06658), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

gpsd is the widely-used GPS/GNSS multiplexing daemon; gpsprof is its bundled profiling/diagnostic utility that collects satellite and device data and generates gnuplot programs to visualize signal quality. The root cause is CWE-78 (OS Command Injection): the device 'subtype' identifier - populated either from a JSON DEVICES report or from a Garmin-proprietary NMEA PGRMT sentence - is inserted verbatim into a gnuplot set title "..." directive. gnuplot's title strings support backtick command substitution (executing shell commands and inlining their output), and gpsprof only escapes the double-quote character, leaving backticks and shell metacharacters intact. When the victim runs the generated gnuplot program, the substitution fires and the shell executes attacker-supplied commands. The affected component is identified in CPE as cpe:2.3:a:ntpsec:gpsd (the NTPsec gpsd fork).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - update gpsd to a build that includes commit 4c06658e988f4ced1a7a574ce082a22ef625df56 (and companion commits 5581ba19 and 1a6bb7bc), applying the escaping fix for the gnuplot plot title. Because the fix is currently referenced as Git commits rather than a confirmed tagged release, verify your distribution has backported it before relying on package version numbers. Until patched, do not run gpsprof against GPS devices or captured logs from untrusted or unverified sources, and treat DEVICES JSON logs and NMEA PGRMT subtype fields as untrusted input; as a compensating control, manually inspect or sanitize the subtype value (strip backticks and shell metacharacters) before feeding recorded data into the gpsprof/gnuplot workflow, and run the rendering step as an unprivileged, sandboxed user to limit the blast radius of any command execution. Reference the vendor advisory at https://gitlab.com/gpsd/gpsd/-/work_items/404 and https://www.vulncheck.com/advisories/gpsd-gpsprof-command-injection-via-gnuplot-plot-title-subtype-field.