Integer underflow in gpsd - CVE-2025-67269

Vulnerability identifier: #VU121180

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-67269

CWE-ID: CWE-191

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer underflow within the nextstate() function in gpsd/packet.c. A remote attacker can send a specially crafted NAVCOM packet to the affected application, trigger an integer underflow and perform a denial of service attack. 

gpsd
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Anolis OS
openEuler
gpsd (Ubuntu package)
gpsd
python3-gpsd
gpsd-clients
gpsd-debuginfo
gpsd-debugsource
gpsd-devel
gpsd-libs
gpsd-qt
gpsd-qt-devel
gpsd-xclients
gpsd-minimal (Red Hat package)
gpsd (Red Hat package)

Install updates from vendor's website.

gpsd - update to 3.27.1
gpsd (Ubuntu package) - addressed in versions 3.22-4ubuntu2.1, 3.25-3ubuntu3.2, 3.25-5ubuntu1.25.04.1, 3.25-5ubuntu1.25.10.1
gpsd - update to 3.25-3
python3-gpsd - update to 3.25-3
gpsd-clients - update to 3.25-3
gpsd-debuginfo - update to 3.25-3
gpsd-debugsource - update to 3.25-3
gpsd-devel - update to 3.25-3
gpsd-libs - update to 3.25-3
gpsd-qt - update to 3.25-3
gpsd-qt-devel - update to 3.25-3
gpsd-xclients - update to 3.25-3
gpsd - update to 3.25-3
gpsd-clients - update to 3.25-3
gpsd-devel - update to 3.25-3
gpsd-libs - update to 3.25-3
gpsd-qt - update to 3.25-3
gpsd-qt-devel - update to 3.25-3
gpsd-xclients - update to 3.25-3
python3-gpsd - update to 3.25-3
gpsd-minimal (Red Hat package) - update to 3.26.1-1.el9_7.1
gpsd (Red Hat package) - update to 3.26.1-1.el10_1.1

• https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67269/README.md
• https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7

• Multiple vulnerabilities in gpsd
• Ubuntu update for gpsd
• Red Hat Enterprise Linux 10 update for gpsd
• Red Hat Enterprise Linux 9 update for gpsd-minimal
• Anolis OS update for gpsd
• openEuler 24.03 LTS SP4 update for gpsd
• openEuler 24.03 LTS SP3 update for gpsd
• openEuler 24.03 LTS SP1 update for gpsd