Log in Start free

Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck

CVE-2025-34450merbanan/rtl_433 <= 25.02 Stack-based Buffer Overflow

Medium 6.9

In plain English

A medium-severity stack buffer overflow in rtl_433 from merbanan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rtl-433no fix listedDEBIAN-CVE-2025-34450
Debian:13rtl-43325.02-1+deb13u1DEBIAN-CVE-2025-34450
Debian:14rtl-43325.12-1DEBIAN-CVE-2025-34450
Ubuntu:22.04:LTSrtl-433no fix listedUBUNTU-CVE-2025-34450
Ubuntu:24.04:LTSrtl-433no fix listedUBUNTU-CVE-2025-34450
Ubuntu:25.10rtl-433no fix listedUBUNTU-CVE-2025-34450
Ubuntu:26.04:LTSrtl-433no fix listedUBUNTU-CVE-2025-34450
Ubuntu:26.10rtl-433no fix listedUBUNTU-CVE-2025-34450

Affected products (as reported)

VendorProductVersions
merbanan rtl_433 0 – through 25.02

Weakness: CWE-121 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References