rtl_433 CVE-2026-117609

The target must be running rtl_433 (version up to and including 25.12) with the Proflame 2 OOK decoder active, and the attacker must deliver a signal that produces more than seven valid Manchester-coded words to proflame2_mc(), writing past its fixed 7-byte stack buffer. Delivery is either over the air - requiring the attacker to be within radio/RF range (Adjacent), the main limiting factor - or by supplying a crafted signal file to be processed locally. The crash/stack-corruption outcome affects all vulnerable builds, but the escalation to control-flow hijacking is limited to builds compiled WITHOUT stack canaries; builds with stack protection are expected to fault rather than permit code execution. No authentication or user interaction is required (PR:N/UI:N).

Signals are moderate and broadly consistent rather than alarming. The CVSS 4.0 base score of 7.1 is driven by an availability-high impact (VA:H) reachable with no privileges or user interaction (PR:N/UI:N) and low attack complexity (AC:L), but the attack vector is Adjacent (AV:A) - the attacker must be within radio range to transmit the crafted OOK signal, which meaningfully constrains reach compared with a network-exploitable flaw. The vuln.today decision label is 'this_week', which indicates a prompt-but-not-emergency priority consistent with a patched, non-actively-exploited issue. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code or PoC reference is present (only the issue, patch PR/commit, and the VulnCheck advisory), so there is no public exploit identified at time of analysis. The description's most severe claim - control-flow hijacking - is explicitly conditional on 'builds without stack canaries'; on the typical modern build with stack protection, the realistic outcome is a crash (denial of service) rather than code execution, so the integrity impact (VI:L) should be read as conditional. In short, this is a legitimately patch-worthy memory-corruption bug but its real-world risk is bounded by the adjacent radio vector, the niche decoder involved, and the stack-canary dependency for the worst-case outcome; nothing in the data elevates it to an active-exploitation emergency.

An attacker within radio range of a host running rtl_433 transmits a crafted OOK signal containing more than seven valid Manchester-coded words that the Proflame 2 decoder (proflame2_mc) attempts to parse, writing past the 7-byte stack buffer. The same corruption can be triggered offline by feeding rtl_433 a crafted signal file. On most builds this crashes the process (denial of service); on builds compiled without stack canaries the stack corruption may be leveraged for control-flow hijacking. No public exploit code or PoC was identified in the provided data.