RTKLIB EUVD-2026-39530

Exploitation requires that a user or automated process actively open or pass a crafted RINEX file to an RTKLIB-linked application - confirmed by UI:P in the CVSS 4.0 vector, meaning passive user interaction (e.g., opening a file or triggering a processing pipeline) is mandatory. The attack vector is local (AV:L), meaning the malicious file must be present on the local filesystem or accessible to the RTKLIB process; remote network exploitation is not indicated. No authentication or privileges are required (PR:N) once file access is established. The specific triggering condition is the presence of unrecognized RINEX observation codes in the input file - standard, well-formed RINEX files with known observation types do not trigger the flaw. Limiting factors: the local file processing requirement eliminates unauthenticated remote attack paths; a user or pipeline must explicitly process the crafted file; and exploitation is constrained to the RTKLIB process memory space with no subsequent-system scope change. Automated RINEX ingestion pipelines consuming externally sourced or user-uploaded data files represent the highest-risk deployment scenario.

The CVSS 4.0 base score of 4.8 reflects a moderate-severity local vulnerability with user interaction required (AV:L/UI:P). The attack surface is constrained: exploitation requires a user or automated process to open or pass a crafted RINEX file to RTKLIB. Confidentiality impact is low (VC:L), limited to potential disclosure of adjacent global memory; integrity is unaffected (VI:N); availability impact is low (VA:L), manifesting as a reliable crash. No subsequent-system impact is indicated (SC:N/SI:N/SA:N). A publicly available PoC (GitHub issue #797) lowers the exploitation barrier, but the local/user-interaction constraint significantly narrows the real-world attack surface compared to network-exploitable flaws. EPSS data was not provided, preventing a probability-of-exploitation comparison. The CVE is not in the CISA KEV catalog, suggesting no confirmed in-the-wild exploitation at time of analysis. The primary realistic risk is in automated RINEX ingestion pipelines processing externally sourced data files - interactive user workflows are lower risk due to the UI:P constraint.

An attacker crafts a RINEX observation file containing deliberately unrecognized observation type codes and delivers it to a target environment where RTKLIB processes external RINEX data - such as an RTK positioning service ingesting uploaded survey files or an automated geodetic pipeline. When the file is processed, getcodepri computes a negative array index into codepris, triggering an out-of-bounds read that crashes the application and may disclose adjacent global memory contents to the attacker. A public proof-of-concept is available at the upstream GitHub issue tracker, reducing the skill required to reproduce the crash.