CVE catalog

CVE-2025-67268

GPSd vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.79% · Oct 27, 2026

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangpsdsid3.27.5-3fixed
Debiangpsdforky3.27.5-3fixed
Debiangpsdtrixie3.25-5+deb13u2fixed
Debiangpsdbookworm3.22-4.1+deb12u1fixed
Ubuntugpsdnoble3.22-4.1+deb12u1fixed
Ubuntugpsdnoble3.25-3ubuntu3.2fixed
Ubuntugpsd-clientsnoble3.25-3ubuntu3.2fixed
Ubuntugpsd-toolsnoble3.25-3ubuntu3.2fixed
Ubuntulibgps-devnoble3.25-3ubuntu3.2fixed
Ubuntulibgps30t64noble3.25-3ubuntu3.2fixed
Ubuntulibqgpsmm-devnoble3.25-3ubuntu3.2fixed
Ubuntulibqgpsmm30t64noble3.25-3ubuntu3.2fixed
Ubuntupython3-gpsnoble3.25-3ubuntu3.2fixed
Ubuntugpsd16.043.11-3vulnerable
Ubuntugpsd16.043.15-2vulnerable
Ubuntugpsd16.043.15-2build1vulnerable
Ubuntugpsd18.043.16-4vulnerable
Ubuntugpsd18.043.17-3vulnerable
Ubuntugpsd18.043.17-5vulnerable
Ubuntugpsd20.043.17-7vulnerable
Ubuntugpsd20.043.19-3vulnerable
Ubuntugpsd20.043.20-1vulnerable
Ubuntugpsd20.043.20-3vulnerable
Ubuntugpsd20.043.20-4vulnerable
Ubuntugpsd20.043.20-4build1vulnerable
Ubuntugpsd20.043.20-5ubuntu1vulnerable
Ubuntugpsd20.043.20-6vulnerable
Ubuntugpsd20.043.20-8vulnerable
Ubuntugpsd20.043.20-8ubuntu0.1vulnerable
Ubuntugpsd20.043.20-8ubuntu0.2vulnerable
Ubuntugpsd20.043.20-8ubuntu0.4vulnerable
Ubuntugpsd22.043.22-4vulnerable
Ubuntugpsd22.043.22-4ubuntu1vulnerable
Ubuntugpsd22.043.22-4ubuntu2vulnerable
Ubuntugpsd22.043.22-4ubuntu2.1fixed
Ubuntugpsd24.043.25-2ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu3vulnerable
Ubuntugpsd24.043.25-3ubuntu3.1vulnerable
Ubuntugpsd24.043.25-3ubuntu3.2fixed
Ubuntugpsd25.103.25-5ubuntu1vulnerable
Ubuntugpsd25.103.25-5ubuntu1.25.10.1fixed
Ubuntugpsd26.043.25-5ubuntu1vulnerable
Ubuntugpsd26.043.27-1.1vulnerable
Ubuntugpsd26.043.27-1.1ubuntu1fixed
Ubuntugpsd22.043.22-4vulnerable
Ubuntugpsd22.043.22-4ubuntu1vulnerable
Ubuntugpsd22.043.22-4ubuntu2vulnerable
Ubuntugpsd22.043.22-4ubuntu2.1fixed
Ubuntugpsd24.043.25-2ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu2vulnerable
Ubuntugpsd24.043.25-3ubuntu3vulnerable
Ubuntugpsd24.043.25-3ubuntu3.1vulnerable
Ubuntugpsd24.043.25-3ubuntu3.2fixed
Ubuntugpsd25.103.25-5ubuntu1vulnerable
Ubuntugpsd25.103.25-5ubuntu1.25.10.1fixed
Opensusegpsdtumbleweed3.27.3-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangpsdsourcesid3.27.5-0.1not yet assignedNot reported[1124800]
Debiangpsdsourceforky3.27.5-0.1not yet assignedNot reported[1124800]
Debiangpsdsourcetrixie3.25-5+deb13u1not yet assignedNot reported[1124800]
Debiangpsdsourcebookworm3.22-4.1+deb12u1not yet assignedNot reported[1124800]
Ubuntugpsddebnoble3.22-4.1+deb12u1Not reportedNot reportedNot reported
Ubuntugpsddebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugpsd-clientsdebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugpsd-toolsdebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgps-devdebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibgps30t64debnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibqgpsmm-devdebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntulibqgpsmm30t64debnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntupython3-gpsdebnoble3.25-3ubuntu3.2Not reportedNot reportedNot reported
Ubuntugpsddeb22.043.22-4ubuntu2.1Not reportedUBUNTU-CVE-2025-67268Not reported
Ubuntugpsddeb24.043.25-3ubuntu3.2Not reportedUBUNTU-CVE-2025-67268Not reported
Ubuntugpsddeb25.103.25-5ubuntu1.25.10.1Not reportedUBUNTU-CVE-2025-67268Not reported
Ubuntugpsddeb26.043.27-1.1ubuntu1Not reportedUBUNTU-CVE-2025-67268Not reported
Ubuntugpsddeb22.043.22-4ubuntu2.1Not reportedUSN-7948-1Not reported
Ubuntugpsddeb24.043.25-3ubuntu3.2Not reportedUSN-7948-1Not reported
Ubuntugpsddeb25.103.25-5ubuntu1.25.10.1Not reportedUSN-7948-1Not reported
Opensusegpsdrpmtumbleweed3.27.3-1.1Not reportedOPENSUSE-SU-2026:10008-1Not reported

[Debian bug #1124800]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [gpsd-clients]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

  • [gpsd-devel]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

  • [gpsd-qt6-devel]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

  • [libgps32]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

  • [libQgpsmm32]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

  • [python3-gpsd]Unknown

    Source package: [gpsd]

    Details (1)

    • 3.27.5-3.2 · x86_64 · tumbleweed

      Unknown · Fixed: 3.27.3-1.1

      Version impact unknown

      usn · gpsd · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [gpsd]Fixed
    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [gpsd-clients]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [gpsd-tools]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [libgps28]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [libgps-dev]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [libqgpsmm28]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [libqgpsmm-dev]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

  • [python3-gps]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.22-4.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

    • 3.22-4.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 3.22-4.1+deb12u1

      usn · gpsd · debian · bookworm; usn · gpsd · debian · 12

[Debian 13 (Trixie)]

  • [gpsd]Fixed
    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

  • [gpsd-clients]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

  • [gpsd-tools]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

  • [libgps30t64]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

  • [libgps-dev]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

  • [libqgpsmm30t64]Fixed

    Source package: [gpsd]

    Details (2)

    • 3.25-5+deb13u1 · amd64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

    • 3.25-5+deb13u1 · arm64 · trixie

      Fixed · Fixed: 3.25-5+deb13u1

      usn · gpsd · debian · 13

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]