Segmentation Fault Vulnerability in gpsd: Critical Issue in ___interceptor_strtol
Summary
OSV-2026-261: Segv on unknown address in ___interceptor_strtol. Affects gpsd versions >= 4d719d0f956444fa8cc00d988fbb9dda878614f4, < 7eed857de627544fdb8d615380fd5d9f0a317f60. Fixed in 7eed857de627544fdb8d615380fd5d9f0a317f60. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
gpsd is an open-source service daemon that monitors GPS devices and provides a unified interface for accessing GPS data. It is widely used in various applications that require location tracking and navigation. This vulnerability exposes gpsd to a segmentation fault, which can lead to application crashes and potential denial of service.
Vulnerability Detail
The vulnerability arises from a segmentation fault (Segv) occurring at an unknown address during the execution of the ___interceptor_strtol function. This issue was reported by OSS-Fuzz and can lead to crashes in applications utilizing gpsd. The affected versions of gpsd are those introduced between commit ad4ba241f17e9de2b7d779e4c5fb50b790e3c7eb and b0acd202991529dfd2677e8973ebcbe78853d4f5, specifically between the commits 4d719d0f956444fa8cc00d988fbb9dda878614f4 and 7eed857de627544fdb8d615380fd5d9f0a317f60.
How To Fix
Minimum fixed version
7eed857de627544fdb8d615380fd5d9f0a317f60
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the specific functionality that triggers the segmentation fault until the package is updated. Monitor your application for any crashes and consider implementing error handling to manage unexpected behavior.
Conclusion
The segmentation fault vulnerability in gpsd's ___interceptor_strtol function poses a significant risk to applications relying on this package. It is crucial to update to the patched version to mitigate potential crashes and ensure stable operation.
See every vulnerability recorded for gpsd →
FAQ
A segmentation fault is a specific kind of error caused by accessing memory that the program is not allowed to access. It often results in the program crashing.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, Vulert can provide real-time alerts.
Yes, you can implement error handling in your application to manage unexpected crashes and avoid using the affected functionality.
The primary impact is the potential for application crashes, leading to denial of service and affecting user experience.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the gpsd GitLab repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
