Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck
CVE-2026-56788RTKLIB 2.4.3 - Out-of-bounds Read via Negative Array Index in getcodepri
Medium 4.4
In plain English
A medium-severity out-of-bounds read in RTKLIB from tomojitakasu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rtklib | no fix listed | DEBIAN-CVE-2026-56788 |
| Debian:14 | rtklib | no fix listed | DEBIAN-CVE-2026-56788 |
| Ubuntu:22.04:LTS | rtklib | no fix listed | UBUNTU-CVE-2026-56788 |
| Ubuntu:24.04:LTS | rtklib | no fix listed | UBUNTU-CVE-2026-56788 |
| Ubuntu:25.10 | rtklib | no fix listed | UBUNTU-CVE-2026-56788 |
| Ubuntu:26.04:LTS | rtklib | no fix listed | UBUNTU-CVE-2026-56788 |
| Ubuntu:26.10 | rtklib | no fix listed | UBUNTU-CVE-2026-56788 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tomojitakasu | RTKLIB | 0 – through 2.4.3 |
Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
References
- Researcher Disclosure technical-description, exploit
- https://www.vulncheck.com/advisories/rtklib-out-of-bounds-read-via-negative-array-index-in-getcodepri third-party-advisory