Vulnerabilidades do Rtklib Rtklib

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Rtklib Rtklib: 4 registro(s), com versões afetadas e correções.
cpe:2.3:a:rtklib:rtklib

CVE-2026-56789 Média · 6.5 CWE-122 25/06/2026

RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Count

RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64 satellites per epoch to cause heap buffer overflow writes and out-of-bounds stack reads, crashing RTKLIB-based applications including rnx2rtkp and RTKPOST.

CVE-2026-56788 Alta · 7.1 CWE-125 25/06/2026

RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri

RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.

CVE-2026-56787 Alta · 7.5 CWE-193 25/06/2026

RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message

RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.

CVE-2026-56786 Crítica · 9.8 CWE-787 25/06/2026

Escrita fora dos limites em decode_type1033 no RTKLIB

O RTKLIB até a versão 2.4.3, inclusive, contém uma vulnerabilidade de escrita fora dos limites (out-of-bounds write) na função decode_type1033, que não limita os contadores de comprimento ao tamanho do buffer de destino, permitindo um estouro de até 191 bytes em campos descritores fixos de 64 bytes. Um atacante que controle um fluxo de correção RTCM3 via NTRIP ou serial pode elaborar uma mensagem do tipo 1033 válida, com CRC, para corromper membros adjacentes do objeto rtcm_t, potencialmente alcançando execução arbitrária de código ou negação de serviço.