| Name | CVE-2026-56786 |
| Description | RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1140766 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| rtklib (PTS) | bullseye | 2.4.3+dfsg1-2.1 | vulnerable |
| forky, sid, bookworm, trixie | 2.4.3.b34+dfsg-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| rtklib | source | (unstable) | (unfixed) | | | 1140766 |
Notes
[trixie] - rtklib <no-dsa> (Minor issue)
[bookworm] - rtklib <postponed> (Minor issue; the decode_type1033 overflow past the 64-byte sta_t descriptor fields consists only of strncpy NUL padding, no attacker-controlled bytes escape the field, and it requires an attacker-controlled RTCM3/NTRIP correction stream)
[bullseye] - rtklib <postponed> (Minor issue; the decode_type1033 overflow past the 64-byte sta_t descriptor fields consists only of strncpy NUL padding, no attacker-controlled bytes escape the field, and it requires an attacker-controlled RTCM3/NTRIP correction stream)
https://github.com/tomojitakasu/RTKLIB/issues/799