CVE-2025-67268: n/a
A heap-based out-of-bounds write vulnerability exists in gpsd prior to commit dc966aa in the handling of NMEA2000 PGN 129540 packets. The vulnerability arises because the satellite count provided by a user is not properly validated against the fixed size of the skyview array, allowing writes beyond its bounds. This can lead to memory corruption, denial of service, and potentially arbitrary code execution. Red Hat has issued a security update for gpsd in Red Hat Enterprise Linux 10.0 Extended Update Support to address this issue.
AI Analysis
Technical Summary
CVE-2025-67268 is a critical heap-based out-of-bounds write vulnerability in gpsd's driver_nmea2000.c file, specifically in the hnd_129540 function that processes NMEA2000 PGN 129540 (GNSS Satellites in View) packets. The function fails to validate the user-supplied satellite count against the skyview array size of 184 elements, allowing an attacker to specify a satellite count up to 255. This leads to writes beyond the array boundary, causing memory corruption. The impact includes potential denial of service and arbitrary code execution. Red Hat Product Security has released an official fix for this vulnerability in Red Hat Enterprise Linux 10.0 Extended Update Support. The CVSS v3.1 base score is 9.8, indicating critical severity.
Potential Impact
Exploitation of this vulnerability can result in memory corruption, which may cause denial of service or allow an attacker to execute arbitrary code on the affected system. The vulnerability affects gpsd, a daemon that provides GPS sensor data to client applications, potentially impacting any system using vulnerable versions of gpsd. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
An official security update is available from Red Hat that addresses this vulnerability. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply the gpsd update as detailed in Red Hat advisory RHSA-2026:1621. The update fixes the heap-based out-of-bounds write in NMEA2000 packet handling. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are required beyond applying the official patch.
CVE-2025-67268: n/a
Description
A heap-based out-of-bounds write vulnerability exists in gpsd prior to commit dc966aa in the handling of NMEA2000 PGN 129540 packets. The vulnerability arises because the satellite count provided by a user is not properly validated against the fixed size of the skyview array, allowing writes beyond its bounds. This can lead to memory corruption, denial of service, and potentially arbitrary code execution. Red Hat has issued a security update for gpsd in Red Hat Enterprise Linux 10.0 Extended Update Support to address this issue.
CVSS v3.1
Score 9.8critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-67268 is a critical heap-based out-of-bounds write vulnerability in gpsd's driver_nmea2000.c file, specifically in the hnd_129540 function that processes NMEA2000 PGN 129540 (GNSS Satellites in View) packets. The function fails to validate the user-supplied satellite count against the skyview array size of 184 elements, allowing an attacker to specify a satellite count up to 255. This leads to writes beyond the array boundary, causing memory corruption. The impact includes potential denial of service and arbitrary code execution. Red Hat Product Security has released an official fix for this vulnerability in Red Hat Enterprise Linux 10.0 Extended Update Support. The CVSS v3.1 base score is 9.8, indicating critical severity.
Potential Impact
Exploitation of this vulnerability can result in memory corruption, which may cause denial of service or allow an attacker to execute arbitrary code on the affected system. The vulnerability affects gpsd, a daemon that provides GPS sensor data to client applications, potentially impacting any system using vulnerable versions of gpsd. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
An official security update is available from Red Hat that addresses this vulnerability. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply the gpsd update as detailed in Red Hat advisory RHSA-2026:1621. The update fixes the heap-based out-of-bounds write in NMEA2000 packet handling. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigation steps are required beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0770
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-67269"]
- Cvss Version
- null
Threat ID: 6a27e99f8dd33fbd8516d6c2
Added to database: 06/09/2026, 10:23:27 UTC
Last enriched: 07/15/2026, 16:16:15 UTC
Last updated: 07/26/2026, 20:52:02 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.