CVE-2026-56786

Name of the Vulnerable Software and Affected Versions RTKLIB versions prior to 2.4.4

Description An out-of-bounds write occurs in the decode type1033() function because length counters are not clamped to the destination buffer size. This allows an overflow of up to 191 bytes into fixed 64-byte descriptor fields. An attacker who controls an NTRIP or serial RTCM3 correction stream can send a crafted type-1033 message with a valid CRC to corrupt adjacent rtcm t object members, which may lead to arbitrary code execution or denial of service.

Recommendations Update to a version newer than 2.4.3.