Homepage

CVE-2025-67269 The advisory has been revoked - it doesn't affect any version of package gpsd-clients  (opens in a new tab)

Threat Intelligence

EPSS
0.56% (45th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX10-GPSDCLIENTS-15053905
  • published22 Jan 2026
  • disclosed19 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 19 Jan 2026

CVE-2025-67269  (opens in a new tab)

Amendment

The AlmaLinux security team deemed this advisory irrelevant for AlmaLinux:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gpsd-clients package and not the gpsd-clients package as distributed by AlmaLinux.

An integer underflow vulnerability exists in the nextstate() function in gpsd/packet.c of gpsd versions prior to commit ffa1d6f40bca0b035fc7f5e563160ebb67199da7. When parsing a NAVCOM packet, the payload length is calculated using lexer->length = (size_t)c - 4 without checking if the input byte c is less than 4. This results in an unsigned integer underflow, setting lexer->length to a very large value (near SIZE_MAX). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.