CVE-2026-56786: RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message

Synopsis

An out-of-bounds write vulnerability exists in RTKLIB 2.4.3 inside the decode_type1033 function, which processes incoming RTCM3 correction stream messages. The function fails to clamp length counters to the size of fixed 64-byte descriptor fields, allowing a crafted type-1033 message to overflow up to 191 bytes into adjacent memory on the rtcm_t object. An attacker who controls an NTRIP caster or serial RTCM3 feed and can reach the affected service over the network, without any authentication, achieves arbitrary code execution or causes a denial of service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the RTKLIB NTRIP or serial RTCM3 intake endpoint over the network; the CVSS vector specifies AV:N, meaning exposure exists across any network path that can deliver a crafted RTCM3 stream to the service.

• AuthenticationNot required

  No credentials or account are needed; the CVSS vector specifies PR:N, so any unauthenticated party that can deliver a type-1033 RTCM3 message to the service can trigger the overflow.

• Victim interactionNot required

  The vulnerability is triggered entirely by the incoming data stream; UI:N means no user action such as clicking a link or opening a file is involved.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race condition, specific memory layout, or environmental precondition beyond network access to the RTCM3 feed endpoint.

Blast Radius

• An attacker writes up to 191 bytes past the end of fixed 64-byte descriptor fields, corrupting adjacent rtcm_t object members in process memory.
• Corrupted object members enable arbitrary code execution within the context of the RTKLIB process, giving the attacker full control over that process.
• The RTKLIB process crashes if the memory corruption does not lead to code execution, taking down any GNSS positioning or correction service that depends on it.
• Confidential data accessible to the RTKLIB process, including positioning state, session tokens, or connected data sinks, is exposed to the attacker (VC:H).