CVE-2026-60122

A flaw was found in gpsd. This code injection vulnerability in the gpsprof utility allows an attacker to execute arbitrary operating system (OS) commands. By controlling GPS input data, an attacker can inject malicious content into the SKY.satellites[].used field. This unsanitized input is then processed by gnuplot, enabling the attacker to run commands as the user executing gpsprof.

This Important flaw in the gpsprof utility, part of the gpsd package, allows arbitrary OS command execution. Exploitation requires a local attacker to provide specially crafted GPS input data and for a user to process this malicious data with gpsprof. This can lead to a complete system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.