{"id":"CVE-2025-67269","details":"An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer-\u003elength = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer-\u003elength` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.","modified":"2026-10-06T02:34:14.103312219Z","published":"2026-01-02T00:00:00Z","related":["ALSA-2026:0770","ALSA-2026:0771","openSUSE-SU-2026:10008-1"],"database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67269.json"},"references":[{"type":"WEB","url":"https://github.com/Jaenact/gspd_cve/blob/main/CVE-2025-67269/README.md"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-67269.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:0770"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:0771"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-67269"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67269.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67269"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426810"},{"type":"FIX","url":"https://gitlab.com/gpsd/gpsd/-/commit/ffa1d6f40bca0b035fc7f5e563160ebb67199da7"},{"type":"PACKAGE","url":"https://gitlab.com/gpsd/gpsd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gpsd/gpsd","events":[{"introduced":"0"},{"fixed":"af42bc1533c926d6e776c9e4c0536d7f861692b4"},{"fixed":"ffa1d6f40bca0b035fc7f5e563160ebb67199da7"}],"database_specific":{"cpe":"cpe:2.3:a:gpsd_project:gpsd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.27.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["release-3.27","release-3.26.1","release-3.26","release-3.25","release-3.24","release-3.23.1","release-3.23","release-3.22","release-3.21","release-3.20","release-3.19","dev-3.19a","release-3.18.1","dev-3.19","release-3.18","release-3.17","release-3.16","release-3.15","release-3.14","release-3.13","release-3.12","release-3.11","release-3.10","release-3.9","release-3.8","release-3.7","release-3.6","release-3.5","release-3.4","release-3.3","release-3.2","Hejira","release-3.1","release-3.0","release-2.96","release-2.95","release-2.94","release-2.93","subversion-cutover","release-2.92","release-2.91","release-2.90","release-2.39","release-2.38","release-2.37","release-2.36","release-2.35","release-2.34","release-2.33","release-2.32","release-2.31","release-2.30","release-2.29","release-2.28","release-2.27","release-2.26","release-2.25","release-2.24","release-2.23","release-2.22","release-2.21","release-2.20","release-2.19","release-2.18","release-2.17","release-2.16","release-2.15","release-2.14","release-2.13","release-2.12","release-2.11","release-2.10","release-2.9","release-2.8","release-2.7","release-2.6","release-2.5","release-2.4","release-2.3","release-2.2","release-2.1","release-2.0","release-1.97","release-1.96","release-1.90"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-67269.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}