| Name | CVE-2026-56788 |
| Description | RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1140766 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| rtklib (PTS) | bullseye | 2.4.3+dfsg1-2.1 | vulnerable |
| bookworm | 2.4.3.b34+dfsg-1 | fixed |
| forky, sid, trixie | 2.4.3.b34+dfsg-1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| rtklib | source | bookworm | (not affected) | | | |
| rtklib | source | (unstable) | (unfixed) | | | 1140766 |
Notes
[trixie] - rtklib <no-dsa> (Minor issue)
[bookworm] - rtklib <not-affected> (Negative codepris[] index not reachable; 2.4.3 b34 getcodepri() guards with "if ((j=code2idx(sys,code))<0) return 0", and code2idx returns at most 4 < MAXFREQ)
[bullseye] - rtklib <postponed> (Minor issue; codepris[i][-1] over-read on an unrecognised observation code, requires processing an attacker-supplied RINEX observation file)
https://github.com/tomojitakasu/RTKLIB/issues/797