CVE-2025-34450 is a stack-based buffer overflow vulnerability identified in the rtl_433 software maintained by merbanan. The vulnerability resides in the parse_rfraw() function within src/rfraw.c, where the application processes raw radio frequency (RF) input data. Versions up to and including 25.02 and prior to commit 25e47f8 are affected. When rtl_433 processes crafted or excessively large raw RF input, it may write beyond the bounds of a stack-allocated buffer, resulting in memory corruption or a crash. This type of vulnerability is classified under CWE-121, indicating a classic stack-based buffer overflow. The overflow can cause denial of service by crashing the application, and under certain conditions—depending on the execution environment, compiler protections (such as stack canaries, ASLR), and privilege levels—may be leveraged for further exploitation, potentially allowing arbitrary code execution. The CVSS 4.0 vector indicates a local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and no impact on confidentiality, integrity, or availability directly, but with high impact on availability (VA:H). No known exploits are currently reported in the wild, but the vulnerability is public and patched in versions after commit 25e47f8. rtl_433 is commonly used for decoding signals from various RF devices including weather stations, sensors, and IoT devices, often in hobbyist, research, and industrial telemetry contexts. The vulnerability's exploitation requires the attacker to supply malicious raw RF data that rtl_433 processes, which may require physical proximity or control over RF input sources.

For European organizations, the primary impact of CVE-2025-34450 is the potential for denial of service on systems running vulnerable rtl_433 versions, which could disrupt telemetry, sensor data collection, or IoT device monitoring. In environments where rtl_433 is integrated into critical infrastructure monitoring or industrial control systems, such disruptions could have operational consequences. Furthermore, if the environment lacks modern exploit mitigations, there is a risk that the vulnerability could be escalated to remote code execution, leading to broader compromise. Given rtl_433’s use in research, hobbyist, and niche industrial applications, the scale of impact is limited but non-negligible. Organizations relying on rtl_433 for RF signal decoding should consider the risk of attackers injecting crafted RF signals to trigger the overflow. The vulnerability does not affect confidentiality or integrity directly but impacts availability and potentially system integrity if exploited further. The lack of known exploits reduces immediate risk but does not eliminate it, especially as the vulnerability is publicly disclosed.

1. Upgrade rtl_433 to a version that includes the fix after commit 25e47f8 or later than version 25.02. 2. Restrict sources of raw RF input data to trusted and controlled environments to prevent injection of maliciously crafted signals. 3. Employ runtime protections such as stack canaries, ASLR, and DEP on systems running rtl_433 to reduce exploitability. 4. Monitor rtl_433 application logs and system behavior for crashes or anomalies indicative of exploitation attempts. 5. If rtl_433 is used in critical environments, consider isolating the decoding process within sandboxed or containerized environments to limit impact of potential compromise. 6. Conduct regular security assessments of RF input channels and physical security to prevent unauthorized RF signal injection. 7. Engage with rtl_433 community or vendor channels for updates and patches promptly. 8. Implement network segmentation and strict access controls around systems processing RF data to limit lateral movement if exploitation occurs.