RTKLIB EUVD-2026-39529

Exploitation requires that the target RTKLIB instance (version 2.4.3 or earlier) is actively receiving RTCM3 SSR correction messages - either via a live NTRIP connection to a correction service or via a serial data channel carrying RTCM3 streams. The attacker must be positioned to control or inject into that correction stream: operating a malicious NTRIP caster that the rover connects to, performing MITM on an unencrypted NTRIP session, or having logical or physical access to the serial correction link. No authentication to RTKLIB itself is required per the CVSS PR:N rating - the vulnerability triggers purely on processing the malformed message content. RTKLIB instances operating in standalone mode without any external correction stream input are not exposed. The specific trigger is attacker-controlled signal mode field values in an SSR message that cause the off-by-one index to read beyond the valid buffer boundary.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects low-complexity unauthenticated network exploitation with no preconditions, which accurately characterizes accessibility of the vulnerability. The 4.0 vector rates VC:L and VA:L, suggesting limited confidentiality exposure from the OOB read and modest availability impact; however, the description explicitly states crash-level denial of service against CORS servers and rovers, which warrants treating availability impact as more severe than the 4.0 baseline suggests - this discrepancy should be verified against the upstream fix. A publicly available POC confirmed by VulnCheck meaningfully elevates real-world risk beyond the raw score. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantitatively anchored. KEV status is not confirmed, suggesting no documented widespread active exploitation as of analysis date. For GNSS-dependent operations (autonomous vehicles, precision agriculture, geodetic infrastructure), even a transient DoS crash carries significant operational consequence disproportionate to the numeric score.

An attacker who controls or can inject into an NTRIP correction stream - for example, by operating a malicious caster or performing a man-in-the-middle attack on an unencrypted NTRIP session - sends an SSR message with attacker-crafted signal mode fields to a target RTKLIB rover or CORS server instance. The off-by-one boundary miscalculation in decode_ssr3 triggers an out-of-bounds read that corrupts adjacent global buffer memory, causing the RTKLIB process to crash and terminating GNSS correction services. A publicly available POC demonstrates the crash trigger, lowering attacker skill requirements significantly.