{"id":"CVE-2026-117609","title":"rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder","summary":"rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-121"],"vendor":"merbanan","product":"rtl_433","affected":["rtl_433 >= 21.12 <= 25.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T14:35:22.684428Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:12:02.323Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117609","references":[{"url":"https://github.com/merbanan/rtl_433/issues/3739"},{"url":"https://github.com/merbanan/rtl_433/pull/3740"},{"url":"https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186"},{"url":"https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95"},{"url":"https://github.com/merbanan/rtl_433"},{"url":"https://www.vulncheck.com/advisories/rtl-433-through-25.12-stack-based-buffer-overflow-via-proflame-2-decoder","label":"VulnCheck Advisory: rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder"}],"tags":["cve.org"],"epss":0.0035,"epssPercentile":0.28837,"ingestedAt":"2026-10-28T03:02:57.628Z","slug":"CVE-2026-117609","body":"## Overview\n\nrtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.\n\n## Affected\n\n- `rtl_433 >= 21.12 <= 25.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}