EUVD-2026-39529
GHSA-8p7j-vhgr-rcw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered unauthenticated message triggers crash (A:H); OOB read may expose memory (C:L); no integrity impact; scope unchanged to RTKLIB process.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.
AnalysisAI
Off-by-one out-of-bounds read in RTKLIB's decode_ssr3 function (src/rtcm3.c:1446) allows unauthenticated remote attackers to trigger a global buffer overflow by sending crafted RTCM3 SSR correction messages with attacker-controlled signal mode fields over NTRIP or serial connections. All RTKLIB versions through 2.4.3 are affected, with the primary impact being denial of service or crash of GNSS rovers and CORS server deployments. A publicly available exploit exists per VulnCheck intelligence, though this vulnerability is not confirmed in CISA KEV at time of analysis.
Technical ContextAI
RTKLIB is an open-source C library by Tomoji Takasu for standard and precise GNSS (Global Navigation Satellite System) positioning, widely used in surveying, autonomous navigation, agriculture, and continuously operating reference station (CORS) infrastructure. The vulnerable decode_ssr3 function parses RTCM3 State Space Representation (SSR) messages - a correction data format transmitted over NTRIP (Networked Transport of RTCM via Internet Protocol) or serial links to improve differential GPS accuracy. CWE-193 (Off-by-One Error) identifies the root cause: the boundary check in the signal mode field processing loop at rtcm3.c:1446 is miscounted by one, permitting an out-of-bounds read that overflows into a global buffer region when an attacker crafts SSR messages with unexpected signal mode values. The CPE cpe:2.3:a:tomojitakasu:rtklib:*:*:*:*:*:*:*:* covers the entire release lineage through 2.4.3 with no version exclusions.
RemediationAI
No vendor-released patched version is independently confirmed at time of analysis - the fix is tracked in the upstream GitHub issue at https://github.com/tomojitakasu/RTKLIB/issues/798 but no tagged release incorporating the correction has been referenced in available intelligence. Operators should monitor the RTKLIB repository for a patched release and upgrade immediately upon availability. As compensating controls: restrict NTRIP source connections to an allowlist of trusted, verified CORS providers at the network perimeter (trade-off: reduces flexibility for field-roaming operations); if SSR correction processing is not required for a specific deployment mode, disable SSR message decoding at the application configuration level (trade-off: eliminates SSR-based accuracy improvements); run RTKLIB processes under process-level isolation such as containers or systemd sandboxing with RestrictAddressFamilies and MemoryDenyWriteExecute to limit blast radius if the overflow is triggered (trade-off: requires deployment changes); for serial-connected deployments, physically and logically restrict access to the RTCM3 data link to prevent injection.
Out-of-bounds write in RTKLIB's decode_type1033 function affects all versions through 2.4.3, where unclamped length coun
Denial-of-service memory corruption in RTKLIB through version 2.4.3 lets an attacker crash GNSS post-processing applicat
Out-of-bounds read in RTKLIB through 2.4.3 exposes users to denial of service and potential memory disclosure when proce
Same weakness CWE-193 – Off-by-one Error
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today