Critical UNKNOWN WRITE Vulnerability in gpsd Package
Summary
OSV-2026-300: UNKNOWN WRITE in nmeaid_to_prn. Affects gpsd versions >= 4d719d0f956444fa8cc00d988fbb9dda878614f4, < da585617443d657b654ca42fe05996eb7a334a38. Fixed in da585617443d657b654ca42fe05996eb7a334a38. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gpsd is an open-source service that monitors GPS devices and provides a unified interface for accessing GPS data. It is widely used in various applications that require location tracking and navigation. The package is known for its efficiency and support for multiple GPS protocols. However, it has recently been identified to have a critical vulnerability that could lead to unexpected behavior and potential data corruption.
Vulnerability Detail
The vulnerability, identified as an UNKNOWN WRITE in the nmeaid_to_prn function, originates from a flaw in the code that processes NMEA data. This issue can lead to crashes and unpredictable behavior when the function is executed, potentially allowing attackers to exploit the vulnerability to cause denial of service or data corruption. The crash state indicates that the function fails during the parsing process, which can be triggered by malformed input.
How To Fix
Minimum fixed version
da585617443d657b654ca42fe05996eb7a334a38
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the nmeaid_to_prn function until the package is updated. Additionally, validating input data before processing can help mitigate the risk of triggering the vulnerability.
Conclusion
The gpsd package has a critical UNKNOWN WRITE vulnerability that can lead to crashes and data corruption. Users are strongly advised to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for gpsd →
FAQ
The vulnerability is an UNKNOWN WRITE that occurs in the nmeaid_to_prn function, leading to potential crashes and data corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to application crashes, denial of service, and potential data corruption.
Yes, a patch is available in the version da585617443d657b654ca42fe05996eb7a334a38. Users should update to this version to mitigate the vulnerability.
If immediate updates are not possible, avoid using the affected function and validate input data to reduce the risk of triggering the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for gpsd.
