CVE-2026-56789 is a heap buffer overflow vulnerability in RTKLIB through version 2.4.3. The issue is located in the readrnxobsb function in src/rinex.c, where satellite count values from RINEX epoch headers are not properly clamped. Attackers can exploit this by providing malicious RINEX files declaring more than 64 satellites per epoch, triggering heap buffer overflow writes and out-of-bounds stack reads. This leads to memory corruption and crashes in RTKLIB-based applications including rnx2rtkp and RTKPOST. The CVSS 4.0 base score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation can cause heap buffer overflow and out-of-bounds stack reads, leading to memory corruption and application crashes in RTKLIB-based software. There is no evidence of known exploits in the wild. The vulnerability does not indicate code execution or data disclosure but results in denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should avoid processing untrusted RINEX files with more than 64 satellites per epoch until a patch is available.