EUVD-2026-39528
GHSA-5cx9-6hw2-hchv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered via RTCM3 with no victim auth or interaction (AV:N/PR:N/UI:N), but AC:H because the attacker must control or MITM the correction stream and craft a CRC-valid frame; memory corruption yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
AnalysisAI
Out-of-bounds write in RTKLIB's decode_type1033 function affects all versions through 2.4.3, where unclamped length counters allow up to a 191-byte overflow into fixed 64-byte descriptor fields when parsing an RTCM3 type-1033 message. An attacker who controls an NTRIP or serial RTCM3 correction stream can deliver a CRC-valid crafted message to corrupt adjacent rtcm_t members, potentially achieving arbitrary code execution or denial of service. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as actively exploited in CISA KEV.
Technical ContextAI
RTKLIB is an open-source GNSS positioning library (by Tomoji Takasu) widely used in RTK/PPP receivers, base stations, drones, and surveying tools. The flaw is rooted in CWE-787 (Out-of-bounds Write): the decode_type1033 routine, which parses RTCM3 message type 1033 (antenna/receiver descriptor and serial number text fields), reads attacker-supplied length counters from the bitstream and copies that many bytes into fixed 64-byte character arrays inside the rtcm_t structure without clamping the count to the destination size. Because RTCM3 length fields can specify up to 255 bytes, copying into a 64-byte buffer permits up to a 191-byte linear overflow, overwriting adjacent rtcm_t object members and any structures laid out after them in memory. RTCM3 is the standard differential-correction protocol carried over NTRIP (HTTP-based GNSS streaming) or direct serial links, so the parser sits on the untrusted input path of any device consuming external corrections. The affected component is identified by CPE cpe:2.3:a:tomojitakasu:rtklib:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patched version is independently confirmed in the provided data; remediation tracking currently points to the upstream GitHub issue (https://github.com/tomojitakasu/RTKLIB/issues/799) and the VulnCheck advisory (https://www.vulncheck.com/advisories/rtklib-out-of-bounds-write-in-decode-type1033-via-crafted-rtcm3-message), so monitor those for a tagged release and upgrade as soon as a fixed build past 2.4.3 is published. Until a patched release is available, apply compensating controls: only consume RTCM3 corrections from trusted, authenticated NTRIP casters and enforce TLS/authentication on the NTRIP connection to prevent malicious-server or MITM injection (trade-off: rules out anonymous/public casters); restrict serial RTCM3 inputs to physically trusted base stations; and where source code is embedded, locally patch decode_type1033 to clamp the descriptor/serial length counters to the 64-byte destination buffer size before copying (trade-off: requires rebuilding from source and validating against legitimate type-1033 messages). Network-segment GNSS receivers and block untrusted inbound NTRIP traffic at the firewall to reduce exposure.
Denial-of-service memory corruption in RTKLIB through version 2.4.3 lets an attacker crash GNSS post-processing applicat
Off-by-one out-of-bounds read in RTKLIB's decode_ssr3 function (src/rtcm3.c:1446) allows unauthenticated remote attacker
Out-of-bounds read in RTKLIB through 2.4.3 exposes users to denial of service and potential memory disclosure when proce
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today