CVE-2026-56786 Details
Description
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
A memory corruption vulnerability has been identified in RTKLIB versions through 2.4.3, specifically within the decode_type1033 function. This out-of-bounds write issue arises because the function does not properly limit length counters to the size of the destination buffer. As a result, up to 191 bytes can overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can exploit this vulnerability by crafting a type-1033 message with a valid CRC. The exploitation can lead to corruption of adjacent members in the rtcm_t object, potentially allowing arbitrary code execution or causing a denial-of-service condition.
It is recommended to clamp the length of each descriptor to the maximum field size before copying the data, and to apply the same fix to the decode_type1007 and decode_type1008 functions, which exhibit similar vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tomojitakasu/RTKLIB/issues/799 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://www.vulncheck.com/advisories/rtklib-out-of-bounds-write-in-decode-type1033-via-crafted-rtcm3-message | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rtklib rtklib | <= 2.4.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |