← Vulnerability feed

Vulnerability record · CVE-2025-67268 · published 2 January 2026

CVE-2025-67268: Gpsd project gpsd heap-based buffer overflow vulnerability

Gpsd Project · Gpsd

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

9.8 CVSS 3.1 Critical EPSS 0.77% · top 46.1% CWE-122 · Heap-based buffer overflowCWE-1285 · CWE-1285
9.8CVSS 3.1 base score
0.77%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
9References, 1 tagged exploit
15 Jul 2026Last modified by NVD

Description

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md ExploitThird Party Advisory
https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c Product
https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4 Patch
https://access.redhat.com/errata/RHSA-2026:0770
https://access.redhat.com/errata/RHSA-2026:0771
https://access.redhat.com/errata/RHSA-2026:1621
https://access.redhat.com/security/cve/CVE-2025-67268
https://bugzilla.redhat.com/show_bug.cgi?id=2426835
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67268.json

Track CVE-2025-67268 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-17937Gpsd project gpsd stack-based buffer overflow vulnerabilitygpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote att…EPSS 2.7%8.4CVE-2026-58459Gpsd project gpsd os command injection vulnerabilitygpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS…EPSS 2.9%7.5CVE-2025-67269Gpsd project gpsd vulnerabilityAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e5…EPSS 0.55%7.5CVE-2023-43628Gpsd project gpsd vulnerabilityAn integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. A specially crafted network packet can lead t…EPSS 1.2%4.3CVE-2013-2038Gpsd project gpsd improper input validation vulnerabilityThe NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code …EPSS 4.2%9.3CVE-2026-94127F5 big-ip access policy manager heap-based buffer overflow vulnerabilityWhen a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution…KEVEPSS 2.2%9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed7.8CVE-2026-85880Windows ALPC heap buffer overflow allows local privilege escalationA heap-based buffer overflow in the Windows ALPC subsystem, combined with use of an uninitialized resource, lets an attacker with existing local acce…KEVEPSS 3.6%analysed

Source: NIST National Vulnerability Database (record CVE-2025-67268), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.