EUVD-2026-39531
GHSA-3fqf-8h5x-pq8x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker-supplied file but victim must open it (UI:R); no auth to craft (PR:N); impact is crash only, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64 satellites per epoch to cause heap buffer overflow writes and out-of-bounds stack reads, crashing RTKLIB-based applications including rnx2rtkp and RTKPOST.
AnalysisAI
Denial-of-service memory corruption in RTKLIB through version 2.4.3 lets an attacker crash GNSS post-processing applications such as rnx2rtkp and RTKPOST by supplying a malicious RINEX observation file. The readrnxobsb function in src/rinex.c fails to clamp the satellite-count value read from RINEX epoch headers, so a file declaring more than 64 satellites per epoch triggers a heap buffer overflow write and out-of-bounds stack reads. Publicly available exploit code exists (VulnCheck/GitHub issue #796); there is no public exploit identified as actively exploited, and the CVSS 4.0 impact is limited to availability (VA:H).
Technical ContextAI
RTKLIB is an open-source GNSS (GPS/GLONASS/Galileo/BeiDou) positioning and post-processing library and toolkit authored by Tomoji Takasu, widely used in surveying, geodesy, and precise-positioning research. The affected component is the RINEX (Receiver Independent Exchange Format) observation-file parser in src/rinex.c. The vulnerability is CWE-122 (heap-based buffer overflow): readrnxobsb reads the per-epoch satellite count directly from attacker-controlled header fields and uses it to index/iterate into fixed-size buffers sized for the RINEX limit of 64 satellites per epoch, without validating or clamping the value. A declared count above 64 causes writes past the end of the heap allocation and out-of-bounds reads on the stack. The single affected product per CPE is cpe:2.3:a:tomojitakasu:rtklib:*:*:*:*:*:*:*:* across all versions up to and including 2.4.3.
RemediationAI
No vendor-released patch version is identified at time of analysis; the upstream reference (https://github.com/tomojitakasu/RTKLIB/issues/796) is an issue report rather than a tagged release or merged fix commit, so monitor that issue and the RTKLIB repository for a patched build and upgrade as soon as one is published. As compensating controls, do not process RINEX observation files from untrusted or unauthenticated sources, and validate or pre-screen input files to reject epochs declaring more than 64 satellites before passing them to rnx2rtkp/RTKPOST (trade-off: requires an external pre-parser and may reject legitimately malformed-but-benign files). Run RTKLIB post-processing in a sandboxed or low-privilege context so that a crash cannot disrupt other workloads, and review the VulnCheck advisory (https://www.vulncheck.com/advisories/rtklib-heap-buffer-overflow-and-stack-read-via-oversized-rinex-epoch-satellite-count) for any updated fix guidance.
Out-of-bounds write in RTKLIB's decode_type1033 function affects all versions through 2.4.3, where unclamped length coun
Off-by-one out-of-bounds read in RTKLIB's decode_ssr3 function (src/rtcm3.c:1446) allows unauthenticated remote attacker
Out-of-bounds read in RTKLIB through 2.4.3 exposes users to denial of service and potential memory disclosure when proce
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today