Yo Wade! I created public issue # for this
https://gitlab.com/gpsd/gpsd/-/work_items/404 No need to hold publication as I just publixhed it. Attaching a simple POC would have been nice. I'll look into a patch soon. CVS of 8.6 is ludicrous. If soumeone can inject NMEA, then the battle is already lost. On Wed, 1 Jul 2026 16:06:50 -0400 Wade Sparks <[email protected]> wrote: > Hello Gary, > > I’m a vulnerability analyst at VulnCheck <https://www.vulncheck.com>, > an exploit intelligence company and research CVE Numbering Authority > (CNA), where I'm one of several folks who manage our coordinated > vulnerability disclosure (CVD) program. > > An external security researcher recently reported > <https://www.vulncheck.com/advisories/report> a potential > vulnerability impacting the GPSD <https://gitlab.com/gpsd/gpsd> > codebase (discovered when testing against version 3.27.5), and > VulnCheck is acting as the intermediary and coordinator. > > VulnCheck follows a 120-day disclosure policy > <https://www.vulncheck.com/vulnerability-disclosure-policy>, meaning > we afford vendors/maintainers up to 120 days from the time of > receiving the report to address the issue before publication of a CVE > record and third-party advisory. For this vulnerability, that 120-day > deadline falls on *October 29, 2026*. > > The following CVE ID has been provisionally reserved for reference > purposes: *CVE-2026-58459*. Reservation does not constitute > publication - the ID will remain in a non-public RESERVED state with > no technical details visible in the CVE database until we have > aligned on CVE-eligibility, disclosure details, and a timeline, or > until the 120-day coordinated disclosure window closes. > > The researcher has provided us with a comprehensive technical report, > which we have attached to this email. Let us know if you have any > questions for us about the CVD process or for the researcher > regarding the reported vulnerability. > > Best regards, > > <https://www.vulncheck.com/> > > Wade Sparks III > VulnCheck > Senior Vulnerability Analyst RGDS GARY --------------------------------------------------------------------------- Gary E. Miller Rellim 109 NW Wilmington Ave., Suite E, Bend, OR 97703 [email protected] Tel:+1 541 382 8588 Veritas liberabit vos. -- Quid est veritas? "If you can't measure it, you can't improve it." - Lord Kelvin
pgp7LXvCRIlNy.pgp
Description: OpenPGP digital signature
