CVE-2025-67269

The gpsd daemon is vulnerable to an integer underflow in the nextstate() function within the gpsd/packet.c component. This flaw occurs during NAVCOM packet parsing when the payload length is calculated as lexer->length = (size_t)c - 4 without verifying if the input byte c is less than 4. The r...

CVE-2013-2038

The CVE-2013-2038 entry concerns the NMEA0183 driver in gpsd (pre-3.9). A malformed GPS packet with a defective $GPGGA interpreted sentence (lacking certain fields/terminator) may cause a denial of service (daemon termination) and possibly allow arbitrary code execution. Public references (SUSE, ...

CVE-2018-17937

GPSD vulnerabilities (CVE-2018-17937) affect gpsd versions 2.90–3.17 and microjson 1.0–1.3. The issue is a stack-based buffer overflow that can allow remote code execution on embedded platforms via traffic on port 2947/TCP or crafted JSON inputs. Impact is described as remote code execution with ...

CVE-2026-58459

CVE-2026-58459 affects gpsd (through release-3.27.5) with a command injection in the gpsprof workflow. The subtype value of the GPS device (sourced from a DEVICES JSON log entry or NMEA PGRMT sentence) is written into a generated gnuplot program via a set title statement that escapes only double ...

CVE-2023-43628

CVE-2023-43628 affects GPSd 3.25.1~dev, with an integer underflow in the NTRIP Stream Parsing path that can cause memory corruption when processing crafted network packets. Talos’ analysis documents the vulnerability as an access/memory corruption issue in GPSd’s NTRIP client, triggered by a malf...

CVE-2025-67268

The gpsd service daemon is vulnerable to a heap-based out-of-bounds write in the drivers/driver_nmea2000.c file. The hnd_129540 function, responsible for handling NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the 184-element sky...