EUVD-2026-39530
GHSA-m65p-fp8q-q43h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file processing with mandatory user interaction, no privileges required, low confidentiality from adjacent memory read, low availability from reliable crash, no integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
AnalysisAI
Out-of-bounds read in RTKLIB through 2.4.3 exposes users to denial of service and potential memory disclosure when processing maliciously crafted RINEX observation files. The getcodepri function fails to validate unrecognized observation codes, performing negative array indexing into the codepris table - producing reliable crashes and leaking adjacent global data segments. A publicly available proof-of-concept exists via the upstream GitHub issue tracker; this CVE is not listed in the CISA KEV catalog, and no EPSS data was provided in available intelligence.
Technical ContextAI
RTKLIB is an open-source GNSS (GPS/GNSS) signal processing library developed by Tomoji Takasu, widely used in RTK positioning, geodetic survey pipelines, and navigation research. RINEX (Receiver Independent Exchange Format) is the de facto standard for exchanging raw satellite observation data, and RTKLIB's getcodepri function is responsible for mapping RINEX observation code strings to internal priority indices in the codepris lookup table. When an unrecognized observation type is encountered, the function computes a negative index rather than returning a safe default, triggering a CWE-125 (Out-of-Bounds Read) condition. The CPE cpe:2.3:a:tomojitakasu:rtklib:*:*:*:*:*:*:*:* covers all versions through 2.4.3 without exception. The root cause is absent input validation on the observation code lookup path - a classic array indexing flaw in a C-based parser.
RemediationAI
No vendor-released patch has been identified at time of analysis - the upstream fix reference points to a GitHub issue (#797) rather than a tagged release, so a released patched version is not independently confirmed. Users should monitor the RTKLIB repository at https://github.com/tomojitakasu/RTKLIB for a new tagged release beyond 2.4.3 that addresses this issue. As immediate compensating controls: disable or restrict RTKLIB-based tools from ingesting RINEX files sourced from untrusted or external parties - this is the most effective near-term mitigation, with the trade-off of disrupting automated external data feeds. Implement upstream input validation to reject RINEX files containing non-standard observation codes before they reach the getcodepri parser. Sandbox RTKLIB processes using OS-level isolation (containers, seccomp profiles, AppArmor policies) to limit blast radius of a crash or memory read - this does not prevent exploitation but reduces impact. Monitoring process crashes on RTKLIB deployments can serve as an exploitation indicator.
Out-of-bounds write in RTKLIB's decode_type1033 function affects all versions through 2.4.3, where unclamped length coun
Denial-of-service memory corruption in RTKLIB through version 2.4.3 lets an attacker crash GNSS post-processing applicat
Off-by-one out-of-bounds read in RTKLIB's decode_ssr3 function (src/rtcm3.c:1446) allows unauthenticated remote attacker
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today