Executive brief
A vulnerability exists in the minmea library, which is used by applications to parse GPS data (NMEA sentences). An attacker can send a specially crafted GPS signal or data stream containing an overly long field to crash the application or potentially take control of the system. This could lead to a loss of GPS functionality or service outages in devices relying on this library for location tracking.
Technical details
A stack-based buffer overflow exists in kosma minmea 0.3.0 within the minmea_scan function. The vulnerability is caused by a format specifier that copies NMEA field data into a caller-provided buffer without verifying the destination buffer's size. An attacker can trigger this overflow by supplying a malicious NMEA sentence with an excessively long field via a spoofed GPS signal or a man-in-the-middle attack on a serial line. While the overflow is restricted to printable ASCII characters (0x20-0x7E) due to validation in minmea_isfield, it can reliably lead to a denial of service (crash) and potentially remote code execution depending on the application's stack layout.
Affected products
- kosma minmea 0.3.0
Timeline
- 2026-03-18: disclosed: Vulnerability discovered and documented by David Williams.
- 2026-05-08: advisory: CVE-2026-29974 published.