Vulnerability · Published Jan 2, 2026 · Assigned by mitre
CVE-2025-67268
Critical 9.8
In plain English
A critical-severity heap buffer overflow in the gpsd package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | gpsd | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux:10 | gpsd-clients | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| AlmaLinux:9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
| AlmaLinux:9 | gpsd-minimal-clients | 1:3.26.1-1.el9_7.1 | ALSA-2026:0771 |
| AlmaLinux:10 | python3-gpsd | 1:3.26.1-1.el10_1.1 | ALSA-2026:0770 |
| Debian:12 | gpsd | 3.22-4.1+deb12u1 | DEBIAN-CVE-2025-67268 |
| Debian:13 | gpsd | 3.25-5+deb13u1 | DEBIAN-CVE-2025-67268 |
| Debian:14 | gpsd | 3.27.5-0.1 | DEBIAN-CVE-2025-67268 |
| Rocky Linux:10 | gpsd | 1:3.26.1-1.el10_1.1 | RLSA-2026:0770 |
| Rocky Linux:9 | gpsd-minimal | 1:3.26.1-1.el9_7.1 | RLSA-2026:0771 |
| Ubuntu:22.04:LTS | gpsd | 3.22-4ubuntu2.1 | UBUNTU-CVE-2025-67268 |
| Ubuntu:24.04:LTS | gpsd | 3.25-3ubuntu3.2 | UBUNTU-CVE-2025-67268 |
| Ubuntu:25.10 | gpsd | 3.25-5ubuntu1.25.10.1 | UBUNTU-CVE-2025-67268 |
| Ubuntu:26.04:LTS | gpsd | 3.27-1.1ubuntu1 | UBUNTU-CVE-2025-67268 |
Affected products (as reported)
Weakness: CWE-122, CWE-1285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4
- https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c
- https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md
- https://access.redhat.com/security/cve/CVE-2025-67268 vdb-entry, x_refsource_REDHAT
- RHBZ#2426835 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67268.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:1621 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0770 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:0771 vendor-advisory, x_refsource_REDHAT