RTKLIB EUVD-2026-39531

Exploitation requires the victim to open or process an attacker-crafted RINEX observation file (UI:P - passive user interaction is mandatory; this is not a remotely triggerable network service). The specific trigger is a RINEX epoch header declaring a satellite count greater than 64 satellites per epoch, which the readrnxobsb function in src/rinex.c fails to clamp. Limiting factors: the attacker cannot self-trigger - a user or an automated pipeline must ingest the malicious file; impact is confined to availability (application crash/DoS, VA:H) with no confidentiality or integrity loss; and only RTKLIB-based consumers of the RINEX observation parser (e.g., rnx2rtkp, RTKPOST) up to 2.4.3 are affected. No authentication is required of the attacker to craft the file (PR:N), but reachability depends on the victim accepting untrusted RINEX input.

Signals are consistent and point to a real but bounded (denial-of-service) risk rather than a critical RCE. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P scores 7.1 (High) but the impact metrics confirm only availability damage (VC:N/VI:N/VA:H) - meaning crash/DoS, not code execution or data disclosure, despite the heap-overflow primitive. UI:P (passive user interaction) means a victim must open or process the attacker-supplied RINEX file, which limits mass automated exploitation. A public POC exists (GitHub issue #796, flagged as exploit by VulnCheck), raising the practical likelihood of crash exploitation, but there is no KEV listing and no EPSS score provided, and no evidence of active exploitation. Note a vector ambiguity: AV:N is assigned, yet exploitation is fundamentally file-parsing - the 'network' vector reflects that malicious RINEX files are typically distributed/downloaded, not a listening network service; verify the deployment path before treating this as remotely reachable without user action. Net priority is moderate: patch on a normal cycle unless RTKLIB processes untrusted third-party RINEX data in an automated pipeline.

An attacker crafts a RINEX observation file whose epoch header declares more than 64 satellites and delivers it to a victim (for example via a shared dataset, email, or a download in an automated processing pipeline). When the victim opens or batch-processes the file with rnx2rtkp or RTKPOST, readrnxobsb overflows the heap buffer and performs out-of-bounds reads, crashing the application. Public exploit code referenced by VulnCheck (GitHub issue #796) demonstrates the trigger.