CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-56786 — RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_typ...

·Source: NIST NVD

Updated:

Executive Summary

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially

Analysis

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially achieving arbitrary code execution or denial of service. CVSS Score: 9.8. Published: 2026-06-25T19:16:44.997.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56786
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Scattered Spider Suspect Extradited From Finland to US

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/scattered-spider-suspect-extradited-from-finland-to-us-image_small-10-a-32140.jpg" align=right hspace=4><b>FBI Says Peter Stokes, 19, 'Exhibited Substantial Wealth for a Person of His Age'</b><br>A suspected member of the notorious Scattered Spider cybercrime group has been extradited from Finland to stand trial in the United Stat

Bank Info Security
MEDIUMVulnerability

Google loses final appeal to overturn €4.1 billion EU fine

Court of Justice of the European Union (CJEU) has dismissed Google's final appeal against a €4.1 billion ($4.7 billion) antitrust fine over the company's use of Android to promote its Chrome browser and search service. [...]

BleepingComputer
MEDIUMVulnerability

Anchorage Digital integrates with Lido to expand institutional access to Ethereum liquid staking

Anchorage Digital, home to America's first federally regulated crypto bank, has integrated with Lido, the largest liquid staking protocol on Ethereum, giving institutions compliant access to wstETH without leaving the Anchorage Digital platform.

Finextra