CVE-2026-56786 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-56786 requires immediate attention.

· 7 min read

Urgent Security Alert: CVE-2026-56786 — A critical out-of-bounds write in RTKLIB through 2.4.3 can let a remote attacker corrupt memory via a crafted RTCM3 correction stream. If your app, service, or device ingests NTRIP or serial GNSS corrections, treat this as a high-priority patch-and-isolate issue now.

Executive Summary

CVE-2026-56786 is a CRITICAL memory corruption flaw in decode_type1033 inside RTKLIB. The bug fails to clamp length counters to the destination buffer size, enabling up to a 191-byte overflow into fixed 64-byte descriptor fields. An attacker who can feed a valid CRC-bearing type-1033 RTCM3 message through NTRIP or a serial correction stream may corrupt adjacent rtcm_t members, causing denial of service and, in some cases, potential arbitrary code execution.

This is especially dangerous for solo developers and small teams because GNSS correction ingestion is often deployed with minimal monitoring, runs continuously, and may be exposed to untrusted upstream streams. Even though there is no known exploitation in the wild and it is not in KEV, the severity and attack surface justify immediate containment.

Immediate Action

  • Stop or isolate any service that accepts untrusted NTRIP/RTCM3 input until you confirm a fixed RTKLIB version is deployed.
  • Upgrade RTKLIB to the first patched release as soon as available. TODO: replace with vendor-fixed version once confirmed; if no patch exists yet, apply the minimal code fix below.
  • Rollback to a known-safe build only if it does not include the vulnerable decode_type1033 code path, or disable type-1033 parsing entirely.
  • Restrict network exposure: allowlist NTRIP caster IPs, place the service behind a VPN, and block public access to correction ingestion ports.
  • Check vendor advisories and upstream release notes: RTKLIB advisory / release notes.

Affected Versions

  • RTKLIB <= 2.4.3 vulnerable; upgrade to TODO_FIXED_VERSION+ when available.
  • rtklib forks or embedded copies that include decode_type1033 from affected upstream code are also vulnerable.
  • RTKLIB 2.4.3 and earlier in source builds, vendor bundles, and firmware images should be treated as exposed until verified otherwise.

Resolution Guide

1) Upgrade or patch immediately. If your package manager tracks RTKLIB as a dependency, update to the fixed release or a commit containing the bounds check.

# npm/yarn/pnpm (if RTKLIB is wrapped by a JS package)
npm i <package-name>@TODO_FIXED_VERSION
yarn add <package-name>@TODO_FIXED_VERSION
pnpm add <package-name>@TODO_FIXED_VERSION

# Python / pip / pipx
pip install --upgrade <package-name>==TODO_FIXED_VERSION
pipx upgrade <package-name>

# Java / Maven / Gradle
mvn versions:use-latest-releases
# or pin the fixed version in pom.xml:
# <version>TODO_FIXED_VERSION</version>

./gradlew dependencies
# then update the RTKLIB wrapper/module version to TODO_FIXED_VERSION

# Debian/Ubuntu
sudo apt update
sudo apt install --only-upgrade <package-name>

# RHEL/CentOS/Fedora
sudo yum update <package-name>
# or
sudo dnf upgrade <package-name>

# Docker
docker pull <image-name>:TODO_FIXED_TAG
docker run --rm <image-name>:TODO_FIXED_TAG

2) Harden configuration. If you cannot patch immediately, disable parsing of untrusted correction streams and narrow the input surface.

# Example: disable external NTRIP ingestion until patched
export NTRIP_ENABLED=false

# Example: only accept loopback/local relay
export RTCM_SOURCE=127.0.0.1

# Example firewall restriction
sudo ufw allow from <trusted_caster_ip> to any port <port>
sudo ufw deny <port>

3) Minimal code fix. The core remediation is to clamp the copied length to the destination buffer size before writing descriptor fields.

// Pseudocode patch for decode_type1033()
// Before copying into a 64-byte descriptor buffer:
size_t max = sizeof(rtcm->desc_field);
size_t n = input_len;
if (n > max - 1) n = max - 1;   // reserve space for NUL
memcpy(rtcm->desc_field, src, n);
rtcm->desc_field[n] = '\0';

Detection & Verification

Check your version:

grep -R "RTKLIB\|2.4.3\|decode_type1033" -n /path/to/your/source /path/to/vendor/bundle

Find vulnerable dependencies:

# Python
pip show <package-name>
pip freeze | grep -i rtk

# Java
mvn dependency:tree | grep -i rtk
./gradlew dependencies | grep -i rtk

# Containers
docker image inspect <image-name>:TAG --format '{{.RepoTags}}'

Verify the fix: confirm the patched code contains a length clamp or equivalent bounds check, then rebuild and redeploy.

grep -n "sizeof.*desc\|min(.*len\|if (.*>.*max" -n src/* rtklib/*

Functional test: feed a benign RTCM3 stream and confirm the service remains stable; then run your normal parser tests with fuzzed or oversized type-1033 payloads in a non-production environment.

Risk and Impact

Successful exploitation can crash the process, corrupt memory, or potentially redirect execution in software that parses attacker-controlled correction data. For small teams, the blast radius often includes a single always-on GNSS service, but that service may support navigation, timing, robotics, or field telemetry—so downtime can cascade quickly. If the parser runs with elevated privileges or inside a larger controller process, the impact can extend beyond a simple crash.

Bottom line: if you use RTKLIB and accept NTRIP or serial RTCM3 from outside your trust boundary, patch or isolate now.

Keep reading