Global Buffer Overflow Vulnerability in gpsd Package
Summary
OSV-2026-307: Global-buffer-overflow in navcom_parse. Affects gpsd versions >= 4d719d0f956444fa8cc00d988fbb9dda878614f4, < 991de2af663565803483e3013fd7dfed48d9355b. Fixed in 991de2af663565803483e3013fd7dfed48d9355b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The gpsd package is an open-source service daemon that monitors one or more GPSes and makes all data available to clients. It is widely used in various applications that require GPS data. The package is designed to be efficient and reliable, but like many software systems, it can be susceptible to vulnerabilities that may compromise its integrity and security.
Vulnerability Detail
The vulnerability identified is a global buffer overflow in the navcom_parse function within the gpsd package. This issue was reported through OSS-Fuzz, indicating that it can lead to a crash due to an attempt to read beyond the allocated buffer size. If exploited, this could potentially allow an attacker to execute arbitrary code or cause denial of service, affecting the stability of applications relying on gpsd.
How To Fix
Minimum fixed version
991de2af663565803483e3013fd7dfed48d9355b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size to the navcom_parse function to prevent buffer overflow. However, this is not a permanent solution and updating to the patched version is strongly advised.
Conclusion
In summary, the gpsd package has a critical global buffer overflow vulnerability that can lead to severe consequences if not addressed. Users are encouraged to update to the latest patched version to ensure the security and stability of their applications.
See every vulnerability recorded for gpsd →
FAQ
A global buffer overflow occurs when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
Exploiting this vulnerability can lead to application crashes or allow attackers to execute arbitrary code, which can compromise the security of your application.
Yes, a patch has been released in version 991de2af663565803483e3013fd7dfed48d9355b of the gpsd package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider implementing input size limitations as a temporary workaround, but prioritize updating to the patched version as soon as feasible.
References
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
