CVE-2025-67268
Full vulnerability record from the local CVENow database.
Description
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2026-01-02 16:17:00.990000
Last modified
2026-11-04 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2025-67268",
"sourceIdentifier": "[email protected]",
"published": "2026-01-02T16:17:00.990",
"lastModified": "2026-11-04T22:10:00.210",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution."
},
{
"lang": "es",
"value": "gpsd antes del commit dc966aa contiene una vulnerabilidad de escritura fuera de límites basada en el heap en el archivo drivers/driver_nmea2000.c. La función hnd_129540, que maneja los paquetes NMEA2000 PGN 129540 (Satélites GNSS a la vista), no valida el recuento de satélites proporcionado por el usuario contra el tamaño del arreglo skyview (184 elementos). Esto permite a un atacante escribir más allá de los límites del arreglo al proporcionar un recuento de satélites de hasta 255, lo que lleva a corrupción de memoria, denegación de servicio (DoS) y potencialmente ejecución de código arbitrario."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"version": "n/a",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gpsd",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"versions": [
{
"version": "1:3.26.1-1.el10_1.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gpsd",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "1:3.25-17.el10_0.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "gpsd-minimal",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"versions": [
{
"version": "1:3.26.1-1.el9_7.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-01-06T16:33:31.263825Z",
"id": "CVE-2025-67268",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-122"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1285"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.27.1",
"matchCriteriaId": "8CBC8583-D71F-4E6F-AB7D-51A3C15270B9"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c",
"source": "[email protected]",
"tags": [
"Product"
]
},
{
"url": "https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0770",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0771",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1621",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-67268",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426835",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67268.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}