# CVE-2025-67268: gpsd heap-based out-of-bounds write in NMEA2000 driver

Source: https://junglewise.ai/threats/cve-2025-67268-gpsd-heap-based-out-of-bounds-write-in-nmea2000-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-67268 · Severity: critical · CVSS 9.8 · Published 2026-01-02

gpsd is a service that translates data from GPS and other sensors for use by other applications. A security flaw in its NMEA2000 driver allows a malicious device on the same local network (such as a vehicle's CAN bus) to send specially crafted packets that crash the service or potentially allow unauthorized code execution. This could lead to a loss of navigation data or a complete system compromise in industrial, maritime, or automotive environments.

Technologies: [Gpsd Project Gpsd](https://junglewise.ai/threats/technologies/gpsd), [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream). Vendors: [Gpsd Project](https://junglewise.ai/threats/vendors/gpsd-project), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-67268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-67268 being exploited in the wild.

**How severe is CVE-2025-67268?** Critical severity, with a CVSS score of 9.8, published 2 January 2026.

**Which products and versions are affected?** Gpsd Project Gpsd before 3.27.1.

**Is there a fix for CVE-2025-67268?** A patch was published on 2025-12-02: Fix committed to master branch (dc966aa) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-67268 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2025-67268?** Check whether you run Gpsd Project Gpsd or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow exists in the hnd_129540 function within drivers/driver_nmea2000.c of gpsd. The vulnerability is caused by a failure to validate the satellite count field (bu[2]) in NMEA2000 PGN 129540 packets against the MAX_CHANNELS limit (typically 184) of the skyview array. An attacker with access to the NMEA2000/CAN bus can inject a packet with a satellite count up to 255, causing a loop to write beyond the array bounds. This results in heap memory corruption, which can be leveraged for Denial of Service (DoS) or potentially arbitrary code execution. The issue is fixed in version 3.27.1 by clamping the satellite count to the array size.

## Affected products

- gpsd project gpsd before 3.27.1
- Red Hat Red Hat Enterprise Linux AppStream (v. 9, 10)

## Timeline

- 2025-12-02: patched: Fix committed to master branch (dc966aa)
- 2025-12-21: disclosed: Public disclosure
- 2026-01-02: advisory: CVE published to NVD

## References

- [https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md](https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67268/README.md)
- [https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c](https://github.com/ntpsec/gpsd/blob/master/drivers/driver_nmea2000.c)
- [https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4](https://github.com/ntpsec/gpsd/commit/dc966aa74c075d0a6535811d98628625cbfbe3f4)
- [https://access.redhat.com/errata/RHSA-2026:0770](https://access.redhat.com/errata/RHSA-2026:0770)
- [https://access.redhat.com/errata/RHSA-2026:0771](https://access.redhat.com/errata/RHSA-2026:0771)
- [https://access.redhat.com/errata/RHSA-2026:1621](https://access.redhat.com/errata/RHSA-2026:1621)
- [https://access.redhat.com/security/cve/CVE-2025-67268](https://access.redhat.com/security/cve/CVE-2025-67268)

## Related threats

- [ntpsec gpsd command injection in gpsprof via gnuplot title](https://junglewise.ai/threats/cve-2026-58459-ntpsec-gpsd-command-injection-in-gpsprof-via-gnuplot-title)
- [CESNET libyang heap buffer overflow in lyb_read_string](https://junglewise.ai/threats/cve-2026-44673-cesnet-libyang-heap-buffer-overflow-in-lyb-read-string)
- [dnsmasq heap out-of-bounds read in extract_addresses](https://junglewise.ai/threats/cve-2026-5172-dnsmasq-heap-out-of-bounds-read-in-extract-addresses)
- [dnsmasq heap out-of-bounds read in DNSSEC validation](https://junglewise.ai/threats/cve-2026-4891-dnsmasq-heap-out-of-bounds-read-in-dnssec-validation)
- [dnsmasq infinite loop in DNSSEC NSEC parsing](https://junglewise.ai/threats/cve-2026-4890-dnsmasq-infinite-loop-in-dnssec-nsec-parsing)