CVE Intelligence
Analysis AI-assisted

CVE-2026-56786: RTKLIB Out-of-Bounds Write in decode_type1033

RTKLIB through 2.4.3 has an out-of-bounds write in the decode_type1033 function, where length counters are not clamped to the destination buffer size. According to the CNA VulnCheck, a crafted RTCM3 correction message delivered over NTRIP or serial could corrupt adjacent memory, and the CVSS 3.1 score is 9.8 (critical). The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

RTKLIB through 2.4.3 contains an out-of-bounds write in the decode_type1033 function. The record states that length counters are not clamped to the destination buffer size, which can allow writes of up to 191 bytes into fixed 64-byte descriptor fields. The weakness is classified as CWE-787. The third-party advisory is available from VulnCheck.

Impact

  • The record describes potential arbitrary code execution or denial of service.
  • According to the description, corruption may affect adjacent members of the rtcm_t object.
  • The CNA VulnCheck provides a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3, both classified as critical severity in the record.

Affected products and versions

  • The record lists the product as Rtklib Rtklib, with versions less than or equal to 2.4.3.
  • The record does not list any fixed version.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation is stated in the sources consulted. The GitHub issue 799 reference is tagged Exploit in the record, but that tag does not establish active exploitation in the wild.

Remediation and mitigation

  • No fixed version is recorded in the consulted data. Check the upstream issue and the project maintainers for verified updates.
  • Until a verified update is applied, limit which correction sources feed RTKLIB and treat NTRIP and serial RTCM3 inputs as untrusted.
  • Isolate systems running RTKLIB from sensitive networks and run them with least privilege.

Detection guidance

  • Monitor for unexpected crashes or restarts of RTKLIB-based processes.
  • Log and review correction stream sources and changes to their connections.
  • Watch hosts running RTKLIB for unusual child processes or outbound connections.

Limitations of the available information

The record does not include a fixed version, a vendor patch, or any statement about versions after 2.4.3. Whether all builds or configurations are affected is unknown. EPSS and SSVC data are absent, and the record does not confirm whether the referenced issue contains working exploit material.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. A GitHub issue is tagged Exploit, but that tag does not confirm exploitation in the wild.

Which versions are affected?

The record lists RTKLIB versions less than or equal to 2.4.3. No fixed version is recorded, so users should check the upstream project for updates.

How can organizations reduce risk now?

Restrict untrusted correction streams, segment networks running RTKLIB, and monitor affected processes while waiting for verified updates from the maintainers.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.