CVE-2026-56786

RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message

9.3 Critical

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.71%Up 0.3 points since Jun 26, 2026

What each source reports

CVE List Score used 9.3

RTKLIB 2.4.3 - Out-of-bounds Write in decode_type1033 via Crafted RTCM3 Message

Record: CVE-2026-56786
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-39528 9.3

Record: EUVD-2026-39528
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5cx9-6hw2-hchv 9.3

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function...

Record: GHSA-5cx9-6hw2-hchv
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 9.3

Record: CVE-2026-56786
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-56786 9.3

Record: DEBIAN-CVE-2026-56786
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-56786 9.3

Record: UBUNTU-CVE-2026-56786
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rtklib` Debian:12	All versions, plus listed versions 2.4.3.b34+dfsg-1	None known
`rtklib` Debian:13	All versions, plus listed versions 2.4.3.b34+dfsg-1	None known
`rtklib` Debian:14	All versions, plus listed versions 2.4.3.b34+dfsg-1	None known
`rtklib` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.3+dfsg1-1	None known
`rtklib` Ubuntu:20.04:LTS	All versions, plus listed versions 2.4.3+dfsg1-12.4.3+dfsg1-2.12.4.3+dfsg1-2.1build1	None known
`rtklib` Ubuntu:22.04:LTS	All versions, plus listed versions 2.4.3+dfsg1-2.1build12.4.3.b34+dfsg-1	None known
`rtklib` Ubuntu:24.04:LTS	All versions, plus listed versions 2.4.3.b34+dfsg-12.4.3.b34+dfsg-1build12.4.3.b34+dfsg-1build2	None known
`rtklib` Ubuntu:25.10	All versions, plus listed versions 2.4.3.b34+dfsg-1build2	None known
`rtklib` Ubuntu:26.10	All versions, plus listed versions 2.4.3.b34+dfsg-1build3	None known
`rtklib` Ubuntu:26.04:LTS	All versions, plus listed versions 2.4.3.b34+dfsg-1build22.4.3.b34+dfsg-1build3	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56786 is a critical vulnerability (CVSS 9.3) in Rtklib, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. No source names a fixed version.