CVE-2026-56789
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
RTKLIB through version 2.4.3 has a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c. Attackers can craft malicious RINEX files declaring more than 64 satellites per epoch, causing heap buffer overflow writes and out-of-bounds stack reads, crashing RTKLIB-based applications like rnx2rtkp and RTKPOST.
Risk Assessment
The risk includes potential remote code execution or denial of service in RTKLIB systems used for navigation and geodesy, leading to data loss, downtime, or manipulation of positioning results.
Recommendation
Immediately update RTKLIB to version 2.4.4 or later if available, or apply a patch to clamp satellite count to 64. Avoid processing untrusted RINEX files.
Other vulnerabilities in RTKLIB
See all- CVE-2026-56786Critical
RTKLIB through version 2.4.3 contains an out-of-bounds write vulnerability in the decode_type1033 function that fails to clamp length counters to the destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
- CVE-2026-56788Medium
RTKLIB through version 2.4.3 contains an out-of-bounds read vulnerability in the getcodepri function when processing unrecognized RINEX observation codes. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, leading to reliable crashes and potential memory disclosure of adjacent global data.
- CVE-2026-56787Medium
RTKLIB through version 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446. Remote attackers can exploit this by sending crafted RTCM3 SSR messages with attacker-controlled signal mode fields, leading to a global buffer overflow.
Original NVD description (English source)
RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64 satellites per epoch to cause heap buffer overflow writes and out-of-bounds stack reads, crashing RTKLIB-based applications including rnx2rtkp and RTKPOST.