---
id: CVE-2026-56789
title: >-
  RTKLIB 2.4.3 - Heap Buffer Overflow and Stack Read via Oversized RINEX Epoch
  Satellite Count
summary: >-
  RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the
  readrnxobsb function in src/rinex.c that allows attackers to trigger memory
  corruption by failing to clamp satellite count values from RINEX epoch
  headers. Attacke…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: tomojitakasu
product: RTKLIB
affected:
  - RTKLIB <= 2.4.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-25T18:24:09.198915Z'
exploitAvailable: true
published: '2026-06-25'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:27.698Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56789'
references:
  - url: 'https://github.com/tomojitakasu/RTKLIB/issues/796'
    label: Researcher Disclosure
  - url: >-
      https://www.vulncheck.com/advisories/rtklib-heap-buffer-overflow-and-stack-read-via-oversized-rinex-epoch-satellite-count
tags:
  - cve.org
  - exploit-available
epss: 0.00422
epssPercentile: 0.36801
ingestedAt: '2026-11-08T14:51:22.327Z'
---

## Overview

RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrnxobsb function in src/rinex.c that allows attackers to trigger memory corruption by failing to clamp satellite count values from RINEX epoch headers. Attackers can craft malicious RINEX files declaring more than 64 satellites per epoch to cause heap buffer overflow writes and out-of-bounds stack reads, crashing RTKLIB-based applications including rnx2rtkp and RTKPOST.

## Affected

- `RTKLIB <= 2.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.