Critical UNKNOWN READ Vulnerability in gpsd Package
Summary
OSV-2026-212: UNKNOWN READ in gpsd_poll. Affects gpsd versions >= 6207b0a06a6c5c33dc366a856529b17244b04d2f, < 454e3a856bdc4c0004fab000f23aec75af41c325. Fixed in 454e3a856bdc4c0004fab000f23aec75af41c325. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is an open-source service daemon that monitors GPS devices and provides location data to client applications. It is widely used in various applications that require GPS data for navigation, tracking, and mapping. The package is known for its ability to handle multiple GPS devices and provide accurate location information. However, it has been identified to have a vulnerability that could lead to potential crashes or data leaks.
Vulnerability Detail
The vulnerability identified in the gpsd package is classified as an UNKNOWN READ, which was reported through OSS-Fuzz. This issue arises in the function gpsd_poll, where improper handling of memory can lead to crashes. The vulnerability was introduced in commit 6207b0a06a6c5c33dc366a856529b17244b04d2f and affects versions of the package prior to the fix implemented in commit 454e3a856bdc4c0004fab000f23aec75af41c325. If exploited, this vulnerability could lead to application crashes, potentially affecting the stability of systems relying on gpsd for GPS data.
How To Fix
Minimum fixed version
454e3a856bdc4c0004fab000f23aec75af41c325
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the gpsd_poll function until the package is updated. This may involve modifying the application code to bypass calls to this function or using alternative methods to retrieve GPS data.
Conclusion
The gpsd package has a critical UNKNOWN READ vulnerability that can lead to application crashes. Users are strongly encouraged to update to the latest patched version to ensure the stability and security of their applications. For real-time monitoring of vulnerabilities, consider using Vulert.
See every vulnerability recorded for gpsd →
FAQ
The UNKNOWN READ vulnerability refers to a situation where the program attempts to read from an invalid memory location, which can lead to crashes or unexpected behavior.
You can use Vulert, which monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The potential impacts include application crashes and instability in systems that rely on gpsd for GPS data, which could disrupt services that depend on accurate location information.
Yes, a patch has been released in the newer versions of the gpsd package. Users are advised to update to the latest version to mitigate the risk.
If immediate updates are not possible, consider implementing workarounds such as avoiding the use of the gpsd_poll function until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
