CVE-2026-56787: RTKLIB Buffer Overflow in RTCM3 SSR Parsing

Technical summary

CVE-2026-56787 is an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 in RTKLIB through version 2.4.3. The flaw exists in the parsing of RTCM3 State Space Representation (SSR) correction messages, specifically in how the signal mode fields are processed. By supplying a crafted SSR message with attacker-controlled signal mode values, a remote attacker can trigger a buffer over-read that exposes adjacent memory or causes a crash. The vulnerability is reachable via any input channel that accepts RTCM3 data: NTRIP (Network RTK over IP) or direct serial connections.

Business impact

Organizations operating GNSS/RTK networks face service disruption risk. CORS operators and survey/mapping teams using RTKLIB-based rovers are vulnerable to denial-of-service attacks from hostile correction stream sources. An attacker positioned to intercept or inject into NTRIP streams or serial connections could crash positioning infrastructure, halting real-time surveying, autonomous vehicle navigation, or precision agriculture operations. The information disclosure component (limited by the CVSS vector) could leak adjacent memory contents, though the primary impact is availability.

Affected systems

RTKLIB versions through 2.4.3 are vulnerable. This includes standalone RTKLIB builds, embedded implementations in survey-grade GNSS receivers, and CORS server software built on RTKLIB. Any system receiving RTCM3 SSR corrections is at risk if running an unpatched version. Common affected use cases include RTK-GPS rovers, CORS networks, and precision positioning applications in industries such as surveying, construction, agriculture, and autonomous systems.

Exploitability

Exploitation requires network or serial access to send RTCM3 messages to the target. No authentication or user interaction is needed. For NTRIP-based deployments, an attacker with network access to the NTRIP caster or able to perform man-in-the-middle on the caster connection can trigger the vulnerability. For serial-connected receivers, physical or logical serial access is required. The attack is straightforward once the malformed message is crafted, making this moderate in exploitability. However, active exploitation in the wild has not been confirmed (KEV status: not listed).

Remediation

Upgrade RTKLIB to a patched version released after 2.4.3. Verify the specific patched version against the official RTKLIB repository or vendor advisory. For interim mitigation, restrict NTRIP and serial connections to trusted sources, implement network segmentation for correction streams, and monitor for unexpected RTK rover crashes or connection anomalies. Validate that any embedded GNSS products or CORS systems using RTKLIB have been updated by their manufacturers.

Patch guidance

Check the RTKLIB GitHub repository or official release notes for versions newer than 2.4.3 that address CVE-2026-56787. Apply patches to all RTKLIB instances in production, including embedded systems and CORS servers. Test patched versions in a staging environment before full rollout, particularly in safety-critical or time-sensitive positioning applications. Confirm that the patch is included in any third-party products bundling RTKLIB, as some may lag behind upstream releases.

Detection guidance

Monitor for repeated RTKLIB crashes or unexpected exits coinciding with NTRIP or serial connection activity. Examine RTCM3 stream logs for malformed SSR messages with unusual signal mode field values. Deploy packet inspection rules to flag RTCM3 messages with out-of-spec signal mode encodings. For CORS operators, establish alerting on rover disconnections or service interruptions following suspect correction stream anomalies. Correlation of crashes across multiple rovers receiving from the same NTRIP source is a strong indicator of active exploitation.

Why prioritize this

Although the CVSS score is moderate (6.5), the vulnerability affects critical positioning infrastructure with real-time operational dependencies. The attack surface is broad for NTRIP-based systems, and successful exploitation causes immediate service impact. Organizations should prioritize patching CORS servers and widely deployed RTK systems ahead of less critical deployments. The lack of KEV listing suggests low current active exploitation, but the ease of weaponization warrants prompt action.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects network-accessible attack vector, low complexity, no privilege or user interaction required, and limited impact (information disclosure and availability). The off-by-one nature limits the scope of corruption, preventing escalation to complete memory disclosure or arbitrary code execution. However, denial of service is certain, and the attack is unauthenticated. Organizations operating mission-critical positioning services should treat this as higher priority than the base score alone suggests.

Frequently asked questions