High severity7.5OSV Advisory· Published Jan 2, 2026· Updated Jul 15, 2026
CVE-2025-67269
CVE-2025-67269
Description
An integer underflow vulnerability exists in the nextstate() function in gpsd/packet.c of gpsd versions prior to commit ffa1d6f40bca0b035fc7f5e563160ebb67199da7. When parsing a NAVCOM packet, the payload length is calculated using lexer->length = (size_t)c - 4 without checking if the input byte c is less than 4. This results in an unsigned integer underflow, setting lexer->length to a very large value (near SIZE_MAX). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9- osv-coords6 versionspkg:rpm/opensuse/gpsd&distro=openSUSE%20Tumbleweedpkg:rpm/almalinux/gpsdpkg:rpm/almalinux/gpsd-clientspkg:rpm/almalinux/python3-gpsdpkg:rpm/almalinux/gpsd-minimalpkg:rpm/almalinux/gpsd-minimal-clients
< 3.27.3-1.1+ 5 more
- (no CPE)range: < 3.27.3-1.1
- (no CPE)range: < 1:3.26.1-1.el10_1.1
- (no CPE)range: < 1:3.26.1-1.el10_1.1
- (no CPE)range: < 1:3.26.1-1.el10_1.1
- (no CPE)range: < 1:3.26.1-1.el9_7.1
- (no CPE)range: < 1:3.26.1-1.el9_7.1
Patches
Vulnerability mechanics
References
7- gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7nvdPatch
- github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67269/README.mdnvdExploitThird Party Advisory
- access.redhat.com/errata/RHSA-2026:0770nvd
- access.redhat.com/errata/RHSA-2026:0771nvd
- access.redhat.com/security/cve/CVE-2025-67269nvd
- bugzilla.redhat.com/show_bug.cginvd
- security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67269.jsonnvd
News mentions
0No linked articles in our index yet.