Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2026-56787RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR Message

Medium 6.5

In plain English

A medium-severity security flaw in RTKLIB from tomojitakasu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	rtklib	no fix listed	DEBIAN-CVE-2026-56787
Debian:14	rtklib	no fix listed	DEBIAN-CVE-2026-56787
Ubuntu:22.04:LTS	rtklib	no fix listed	UBUNTU-CVE-2026-56787
Ubuntu:24.04:LTS	rtklib	no fix listed	UBUNTU-CVE-2026-56787
Ubuntu:25.10	rtklib	no fix listed	UBUNTU-CVE-2026-56787
Ubuntu:26.04:LTS	rtklib	no fix listed	UBUNTU-CVE-2026-56787
Ubuntu:26.10	rtklib	no fix listed	UBUNTU-CVE-2026-56787

Affected products (as reported)

Vendor	Product	Versions
tomojitakasu	RTKLIB	0 – through 2.4.3

Weakness: CWE-193 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/rtklib-off-by-one-out-of-bounds-read-in-decode-ssr3-via-rtcm3-ssr-message third-party-advisory