CVE-2025-34450

Name	CVE-2025-34450
Description	merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rtl-433 (PTS)	bullseye	20.11-1	vulnerable
	bookworm	22.11-1	vulnerable
	trixie	25.02-1	vulnerable
	forky, sid	25.12-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rtl-433	source	(unstable)	25.12-1

Notes

[trixie] - rtl-433 <no-dsa> (Minor issue)
[bookworm] - rtl-433 <no-dsa> (Minor issue)
https://github.com/merbanan/rtl_433/issues/3375
https://github.com/dd32/rtl_433/commit/25e47f8932f0401392ef1d3c8cc9ed5595bc894a