Junglewise Threat Intelligence

CVE-2025-67268: gpsd heap-based out-of-bounds write in NMEA2000 driver

CVE-2025-67268 · Severity: critical · CVSS 9.8 · Published 2026-01-02

Technologies: Red Hat Enterprise Linux AppStream, Gpsd Project Gpsd. Vendors: Red Hat, Gpsd Project.

Executive brief

gpsd is a service that translates data from GPS and other sensors for use by other applications. A security flaw in its NMEA2000 driver allows a malicious device on the same local network (such as a vehicle's CAN bus) to send specially crafted packets that crash the service or potentially allow unauthorized code execution. This could lead to a loss of navigation data or a complete system compromise in industrial, maritime, or automotive environments.

Technical details

A heap-based buffer overflow exists in the hnd_129540 function within drivers/driver_nmea2000.c of gpsd. The vulnerability is caused by a failure to validate the satellite count field (bu[2]) in NMEA2000 PGN 129540 packets against the MAX_CHANNELS limit (typically 184) of the skyview array. An attacker with access to the NMEA2000/CAN bus can inject a packet with a satellite count up to 255, causing a loop to write beyond the array bounds. This results in heap memory corruption, which can be leveraged for Denial of Service (DoS) or potentially arbitrary code execution. The issue is fixed in version 3.27.1 by clamping the satellite count to the array size.

Affected products

  • gpsd project gpsd before 3.27.1
  • Red Hat Red Hat Enterprise Linux AppStream (v. 9, 10)

Timeline

  • 2025-12-02: patched: Fix committed to master branch (dc966aa)
  • 2025-12-21: disclosed: Public disclosure
  • 2026-01-02: advisory: CVE published to NVD

References

Related threats