CVE-2026-117609— rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

Quick assessment

Affected

merbanan rtl_433

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

rtl_433 25.12 及更早版本在 proflame2_mc() 函数中存在一个基于栈的缓冲区溢出漏洞。该漏洞允许附近的攻击者通过发送超过七个有效的曼彻斯特编码字，向一个 7 字节的栈缓冲区写入越界数据。攻击者可传输精心构造的 OOK 无线电信号，或提供精心构造的信号文件，从而触发 rtl_433 崩溃并破坏栈内存。在未启用栈保护机制（stack canaries）的构建版本中，此漏洞可导致控制流劫持。

CVSS 7.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

Source: CVE Program / CVE List V5

Vulnerability Description

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

栈缓冲区溢出

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
merbanan	rtl_433	21.12 ~ 25.12	-

II. Public POCs for CVE-2026-117609

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117609

请登录查看更多情报信息。

Other References for CVE-2026-117609 (6)

https://github.com/merbanan/rtl_433/issues/3739 issue-tracking
https://github.com/merbanan/rtl_433 product
https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95 technical-description
https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186 patch
https://github.com/merbanan/rtl_433/pull/3740 patch issue-tracking
https://www.vulncheck.com/advisories/rtl-433-through-25.12-stack-based-buffer-overflow-via-proflame-2-decoder third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117609

IV. Related Vulnerabilities

Same product: rtl_433

CVE-2025-34450
merbanan/rtl_433 <= 25.02 Stack-based Buffer Overflow

Same vendor: merbanan

CVE-2025-34450
merbanan/rtl_433 <= 25.02 Stack-based Buffer Overflow

Same weakness: CWE-121