CVE-2026-117609 Details
Description
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.
A stack-based buffer overflow vulnerability has been identified in the rtl_433 software, specifically in versions 21.12 through 25.12. The issue arises within the Proflame 2 decoder function, proflame2_mc(). This vulnerability allows nearby attackers to overwrite a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Exploitation can be achieved by transmitting a crafted On-Off Keying (OOK) radio signal or by using a specially designed signal file, which can cause the application to crash and corrupt stack memory. In builds without stack canaries, this memory corruption can be leveraged to hijack control flow and execute arbitrary code.
Users can update to the latest version of rtl_433, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/merbanan/rtl_433 | [email protected] | Vendor |
| https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95 | [email protected] | Source CodeVendor |
| https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186 | [email protected] | Source CodeVendor |
| https://github.com/merbanan/rtl_433/issues/3739 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/merbanan/rtl_433/pull/3740 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/rtl-433-through-25.12-stack-based-buffer-overflow-via-proflame-2-decoder | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rtl_433 | >= 21.12, <= 25.12 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |