CVE-2026-56788: Out-of-bounds Read in tomojitakasu RTKLIB
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
AI Analysis
Technical Summary
CVE-2026-56788 is an out-of-bounds read vulnerability in tomojitakasu RTKLIB through version 2.4.3. The issue occurs in the getcodepri function when it processes unrecognized RINEX observation codes. Specifically, crafted RINEX files containing unknown observation types cause the function to index negatively into the codepris table, which results in reliable application crashes and may disclose adjacent global memory data. This vulnerability can be exploited to cause denial of service and potentially leak memory contents.
Potential Impact
An attacker who can supply malicious RINEX observation files can trigger a denial of service by causing the application to crash due to out-of-bounds reads. There is also a potential for memory disclosure of adjacent global data, which could lead to information leakage. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should avoid processing untrusted or crafted RINEX observation files until a patch or mitigation is available.
CVE-2026-56788: Out-of-bounds Read in tomojitakasu RTKLIB
Description
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
CVSS v4.0
Score 4.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56788 is an out-of-bounds read vulnerability in tomojitakasu RTKLIB through version 2.4.3. The issue occurs in the getcodepri function when it processes unrecognized RINEX observation codes. Specifically, crafted RINEX files containing unknown observation types cause the function to index negatively into the codepris table, which results in reliable application crashes and may disclose adjacent global memory data. This vulnerability can be exploited to cause denial of service and potentially leak memory contents.
Potential Impact
An attacker who can supply malicious RINEX observation files can trigger a denial of service by causing the application to crash due to out-of-bounds reads. There is also a potential for memory disclosure of adjacent global data, which could lead to information leakage. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should avoid processing untrusted or crafted RINEX observation files until a patch or mitigation is available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-23T01:24:27.651Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3d73fd4853345fc14dfabf
Added to database: 06/25/2026, 18:31:25 UTC
Last enriched: 07/15/2026, 10:18:07 UTC
Last updated: 08/08/2026, 12:41:11 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.