---
id: CVE-2026-56787
title: >-
  RTKLIB 2.4.3 - Off-by-One Out-of-Bounds Read in decode_ssr3 via RTCM3 SSR
  Message
summary: >-
  RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability
  in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers
  to trigger a global buffer overflow via crafted RTCM3 SSR messages with
  attacker-co…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-193
vendor: tomojitakasu
product: RTKLIB
affected:
  - RTKLIB <= 2.4.3
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-25T18:27:10.611620Z'
exploitAvailable: true
published: '2026-06-25'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:26.241Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56787'
references:
  - url: 'https://github.com/tomojitakasu/RTKLIB/issues/798'
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/rtklib-off-by-one-out-of-bounds-read-in-decode-ssr3-via-rtcm3-ssr-message
tags:
  - cve.org
  - exploit-available
epss: 0.00564
epssPercentile: 0.47128
ingestedAt: '2026-11-08T14:51:22.331Z'
---

## Overview

RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnerability in the decode_ssr3 function at src/rtcm3.c:1446 that allows remote attackers to trigger a global buffer overflow via crafted RTCM3 SSR messages with attacker-controlled signal mode fields. Remote attackers can exploit this vulnerability by sending malicious SSR correction streams over NTRIP or serial connections to cause denial of service or crash RTKLIB rovers and CORS servers.

## Affected

- `RTKLIB <= 2.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.