CVE-2025-67268

Critical

Description

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

SeverityCritical

CVSS9.8

Exploit probability—

ProductGpsd

PublishedJan 2, 2026

First seenJan 2, 2026

Weakness typeCWE-122CWE-122 CWE-1285CWE-1285

How to fix

Update

gpsd_project gpsd3.27.1 or later

Patches

github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4

Vendor advisories

Affected products

Product	Affected versions	Fixed in
gpsd_project gpsd	v < 3.27.1	3.27.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.