CVE-2026-56786: Out-of-bounds Write in tomojitakasu RTKLIB
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
AI Analysis
Technical Summary
CVE-2026-56786 is a critical out-of-bounds write vulnerability in tomojitakasu RTKLIB through version 2.4.3. The vulnerability exists in the decode_type1033 function, which fails to properly clamp length counters to the size of the destination buffer. This allows an attacker who can send a valid CRC-bearing type-1033 message via an NTRIP or serial RTCM3 correction stream to overflow a fixed 64-byte descriptor field by up to 191 bytes. The overflow corrupts adjacent rtcm_t object members, which may lead to arbitrary code execution or denial of service conditions.
Potential Impact
Successful exploitation can result in memory corruption leading to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without authentication, requiring only the ability to send crafted correction stream messages. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, restrict or monitor access to NTRIP or serial RTCM3 correction streams to trusted sources only to reduce exposure.
CVE-2026-56786: Out-of-bounds Write in tomojitakasu RTKLIB
Description
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56786 is a critical out-of-bounds write vulnerability in tomojitakasu RTKLIB through version 2.4.3. The vulnerability exists in the decode_type1033 function, which fails to properly clamp length counters to the size of the destination buffer. This allows an attacker who can send a valid CRC-bearing type-1033 message via an NTRIP or serial RTCM3 correction stream to overflow a fixed 64-byte descriptor field by up to 191 bytes. The overflow corrupts adjacent rtcm_t object members, which may lead to arbitrary code execution or denial of service conditions.
Potential Impact
Successful exploitation can result in memory corruption leading to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without authentication, requiring only the ability to send crafted correction stream messages. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, restrict or monitor access to NTRIP or serial RTCM3 correction streams to trusted sources only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-23T01:24:27.651Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3d73fd4853345fc14dfab5
Added to database: 06/25/2026, 18:31:25 UTC
Last enriched: 07/15/2026, 10:17:48 UTC
Last updated: 08/09/2026, 00:41:15 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.