RTKLIB CVE-2026-56786

Exploitation requires that the target be actively consuming an attacker-influenced RTCM3 correction stream - either an NTRIP feed the attacker hosts or can man-in-the-middle, or a serial RTCM3 link the attacker can inject into - and that the attacker send a crafted type-1033 message whose CRC is valid (the parser validates CRC, so malformed frames are rejected). No authentication on the victim side and no user interaction are needed per the CVSS vector (PR:N/UI:N), and default RTKLIB builds through 2.4.3 are vulnerable. The principal limiting factor is the need to control or tamper with the correction source: deployments that pull corrections only from trusted, authenticated NTRIP casters over secured links significantly raise the bar, whereas devices configured to accept public or unauthenticated correction streams are directly exposed.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) rates this critical with network reach, low complexity, no privileges, and high confidentiality/integrity/availability impact, consistent with a memory-corruption-to-RCE primitive. EPSS and SSVC values were not provided in the input, so probabilistic exploitation likelihood and an automatable/exploitation-status decision cannot be cross-referenced here. Publicly available exploit code raises practical risk above the typical high-CVSS-without-PROC case, but the listing is not in CISA KEV, so this should be read as exploitable-and-demonstrated rather than confirmed widespread active exploitation. One caveat worth verifying: the vector marks AV:N/PR:N, yet exploitation depends on the attacker controlling the RTCM3 correction stream the victim consumes - i.e., operating a malicious NTRIP caster/server or performing a man-in-the-middle on the correction feed - which is a real-world precondition that can lower the practical attack surface for devices using trusted, authenticated correction providers.

An attacker stands up a rogue NTRIP caster (or MITMs an existing correction feed) that a target RTK receiver or rtkrcv instance is configured to pull corrections from. They send a CRC-valid RTCM3 type-1033 message with oversized descriptor length fields, overflowing the fixed 64-byte buffers and corrupting adjacent rtcm_t members to crash the process or steer execution. Public exploit code referenced by VulnCheck lowers the barrier to reproducing this against vulnerable deployments.