CVE-2026-58459

A flaw was found in gpsd, a service application that monitors one or more GPSes or AIS receivers. The gpsprof utility is vulnerable to a command injection. An attacker who can control the GPS device subtype value can embed malicious commands within the gnuplot plot title. When a user processes a specially crafted plot through gpsprof and gnuplot, these embedded commands can be executed, leading to arbitrary code execution on the system.

An attacker can embed malicious commands within the gnuplot plot title by controlling the GPS device subtype value. When a user processes a specially crafted plot through gpsprof, these commands execute, leading to arbitrary code execution. Exploitation requires user interaction.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.