CVE-2026-56787

Name of the Vulnerable Software and Affected Versions RTKLIB versions prior to 2.4.3

Description An off-by-one out-of-bounds read exists in the decode ssr3() function within the src/rtcm3.c file. This issue occurs when processing crafted RTCM3 SSR messages containing attacker-controlled signal mode fields, which can trigger a global buffer overflow. Remote attackers can exploit this by sending malicious SSR correction streams via NTRIP or serial connections, potentially leading to a denial of service or causing RTKLIB rovers and CORS servers to crash.

Recommendations Update RTKLIB to a version newer than 2.4.3. As a temporary mitigation, restrict the processing of SSR correction streams from untrusted sources.