By vendor

Rtklib vulnerabilities

Known CVEs affecting Rtklib products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-56787MEDIUM 6.5

  RTKLIB versions up to 2.4.3 contain a bug in how they parse RTCM3 satellite correction messages. An attacker can craft malicious correction data that causes the software to read beyond allocated memory boundaries, leading to crashes or potential information disclosure. This affects GPS/GNSS systems that rely on RTKLIB for real-time positioning, particularly rover applications and CORS (Continuously Operating Reference Station) networks that receive corrections over the internet or serial links.

• CVE-2026-56789MEDIUM 6.5

  RTKLIB, a widely-used open-source library for GNSS positioning, contains a memory corruption flaw in how it parses satellite observation data from RINEX files. An attacker can craft a malicious RINEX file that declares an impossibly high number of satellites in a single epoch (more than the valid limit of 64) to trigger a heap buffer overflow. This can crash RTKLIB applications like rnx2rtkp and RTKPOST, potentially disrupting surveying, navigation, and geospatial workflows that depend on these tools.

• CVE-2026-56788MEDIUM 4.4

  RTKLIB, an open-source GNSS/GPS processing toolkit, contains a flaw that crashes the application when it encounters RINEX observation files with unrecognized code types. An attacker can craft malicious RINEX files that trigger the crash and potentially expose sensitive data from the application's memory. The vulnerability affects versions through 2.4.3 and requires user interaction—someone must open or process the malicious file—but no special privileges are needed.