Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-56786— RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message

Quick assessment

Affected
tomojitakasu RTKLIB
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tomoji Takasu RTKLIB是日本Tomoji Takasu个人开发者的一个全球导航卫星系统标准与精确定位算法软件包。 Tomoji Takasu RTKLIB 2.4.3及之前版本存在缓冲区错误漏洞，该漏洞源于decode_type1033函数未将长度计数器限制为目标缓冲区大小，导致越界写入，可能造成任意代码执行或拒绝服务。

CVSS 9.8 · Critical EPSS 0.71% · P52

Affected Version Matrix 1

VendorProduct Version RangeStatus
tomojitakasu RTKLIB ≤ 2.4.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-56786

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message
Source: CVE Program / CVE List V5
Vulnerability Description
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Vulnerability Title
Tomoji Takasu RTKLIB 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tomoji Takasu RTKLIB是日本Tomoji Takasu个人开发者的一个全球导航卫星系统标准与精确定位算法软件包。 Tomoji Takasu RTKLIB 2.4.3及之前版本存在缓冲区错误漏洞，该漏洞源于decode_type1033函数未将长度计数器限制为目标缓冲区大小，导致越界写入，可能造成任意代码执行或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
tomojitakasu RTKLIB 0 ~ 2.4.3 -

II. Public POCs for CVE-2026-56786

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9417 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-56786

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-56786 (1)

Proof of Concept for CVE-2026-56786 (1)

Same Patch Batch · tomojitakasu · 2026-06-25 · 4 CVEs total

CVE-2026-56789 6.5 MEDIUM RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch Satellite Cou
CVE-2026-56787 6.5 MEDIUM RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message
CVE-2026-56788 4.4 MEDIUM RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri

IV. Related Vulnerabilities

Same product: RTKLIB
Same vendor: tomojitakasu
Same weakness: CWE-787

V. Comments for CVE-2026-56786

No comments yet

Leave a comment