Integer Underflow in gpsd Affects GPS Functionality

CVE-2025-67269

What is CVE-2025-67269?

An integer underflow vulnerability exists in the nextstate() function of gpsd's packet parser. This flaw occurs when a NAVCOM packet is parsed, as the length calculation of the payload can result in an underflow scenario if the input byte is less than 4. This improper validation leads to lexer length being set to a significantly large value, which prompts the parser into a consuming loop. As a consequence, this excess consumption causes complete CPU utilization, essentially leading to a Denial of Service condition. Users of affected versions should examine their deployments and apply the necessary updates to mitigate this vulnerability.

References