Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-67268 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Gpsd Project Gpsd. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-67268 is a heap-based out-of-bounds write vulnerability in gpsd versions prior to commit dc966aa. The issue resides in the drivers/driver_nmea2000.c file, specifically within the hnd_129540 function that processes NMEA2000 PGN 129540 (GNSS Satellites in View) packets. This function does not properly validate the user-supplied satellite count—limited to a maximum of 255—against the fixed size of the skyview array, which holds only 184 elements. Sending a crafted packet with a satellite count exceeding 184 triggers an out-of-bounds write, resulting in memory corruption. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-122 (Heap-based Buffer Overflow).
An unauthenticated remote attacker can exploit this vulnerability by transmitting specially crafted NMEA2000 packets to a gpsd instance listening on an affected interface. No privileges, user interaction, or special access are required, making it highly accessible over the network with low complexity. Successful exploitation leads to memory corruption, enabling denial of service (DoS) through crashes or resource exhaustion, and potentially arbitrary code execution if the corruption allows control over execution flow.
Mitigation is available via the fixing commit dc966aa74c075d0a6535811d98628625cbfbe3f4 in the ntpsec/gpsd repository, which addresses the validation flaw in driver_nmea2000.c. Security practitioners should update gpsd to a version incorporating this commit and review deployments for exposure to NMEA2000 traffic sources. Additional details are provided in the advisory at the Jaenact/gspd_cve repository README for CVE-2025-67268.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0661
Vulnerability Data
gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview…
more
array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1V1.4.2V2.1.1V2.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including fuzzing and memory-error detectors) can discover heap overflows after they have been coded.
Input validation enforces bounds checking on data written to heap buffers, directly stopping the overflow condition from being introduced.
Security engineering principles require use of memory-safe constructs and bounds-checked allocation routines that avoid introducing heap overflows.
Memory-protection mechanisms limit the ability of a heap overflow to execute attacker-controlled code or corrupt adjacent structures.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect heap overflows before release.
Secure development lifecycle mandates practices that reduce the likelihood of introducing heap overflows.
Application security requirements can specify bounds-checking and safe memory APIs that mitigate heap overflows.
Secure architecture and engineering principles include memory-safety and input-validation controls that address heap overflows.
Secure coding standards directly prescribe techniques (safe functions, bounds checks) that prevent heap-based buffer overflows.
Change management ensures controlled deployment of fixes for discovered heap-overflow vulnerabilities.