CVE-2026-56788: RTKLIB Out-of-Bounds Read in RINEX Processing

Technical summary

CVE-2026-56788 is an out-of-bounds read vulnerability (CWE-125) in the getcodepri function of RTKLIB. The function fails to validate observation codes present in RINEX files before indexing into the codepris lookup table. When an unrecognized code is encountered, negative array indexing occurs, reading from memory locations outside the intended buffer. This results in denial of service through reliable application crashes and potential information disclosure of adjacent global data structures in memory.

Business impact

Organizations relying on RTKLIB for geodetic surveys, GNSS data processing, or position analysis face operational disruption if attackers distribute crafted RINEX files through legitimate data sharing channels. The memory disclosure risk, though limited by the local attack vector, could expose coordinate data, timestamps, or other adjacent global state. For survey firms, construction, agriculture, or research teams using RTKLIB in production workflows, denial of service translates to project delays and rework.

Affected systems

RTKLIB through version 2.4.3 is affected. This includes standalone applications, embedded integrations in surveying software, and command-line tools that parse RINEX observation files. Any deployment processing untrusted or semi-trusted RINEX input is at risk. The vulnerability does not require network access or elevated privileges to trigger.

Exploitability

Exploitability is straightforward but constrained by attack surface. An attacker must craft a RINEX observation file containing unrecognized code types and convince or trick a user into processing it with a vulnerable RTKLIB version. No authentication, network access, or privilege escalation is required. The reliability of the crash makes denial of service predictable. However, the requirement for user interaction (UI:R in CVSS) and local system access (AV:L) limits the attack scope in most environments.

Remediation

Upgrade RTKLIB to a patched version that validates observation codes before table lookup. Verify against the official RTKLIB project repository for the exact patched version number and release date. Until patching is feasible, restrict processing of RINEX files to trusted sources and educate users not to open RINEX files from untrusted channels.

Patch guidance

Consult the RTKLIB project repository (GitHub or official source) for the earliest available patch. Apply updates to all systems and integrations using RTKLIB, including surveying software, embedded tools, and data processing pipelines. Test patched versions against your standard RINEX workflows to ensure compatibility before full deployment.

Detection guidance

Monitor for repeated application crashes in RTKLIB or dependent tools when processing RINEX files, especially those from external or newly introduced sources. Log RINEX file sources and validate file integrity where possible. Memory monitoring tools may detect the out-of-bounds read behavior in controlled environments. Alert on error messages related to unrecognized observation codes.

Why prioritize this

This vulnerability merits timely but not emergency remediation. The CVSS score of 4.4 (MEDIUM) reflects the dual impact of denial of service and limited information disclosure, offset by the local and user-interaction constraints. The vulnerability is not tracked as an actively exploited KEV, suggesting real-world attacks are not yet widespread. However, denial of service in critical surveying or GNSS workflows justifies prompt patching, and the memory disclosure aspect warrants proactive attention for teams handling sensitive coordinate or timing data.

Risk score, explained

The CVSS 3.1 score of 4.4 is derived from: local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), required user interaction (UI:R), unchanged scope (S:U), low confidentiality impact (C:L) from potential memory disclosure, no integrity impact (I:N), and low availability impact (A:L) from denial of service. The score reflects a real but limited threat; the user-interaction and local-access requirements prevent widespread remote exploitation.

Frequently asked questions