CVE-2026-117609
Received Received - Intake

Stack-Based Buffer Overflow in rtl_433

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-117609
EUVD
EUVD-2026-111544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
merbanan rtl_433 21.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-117609 is a stack-based buffer overflow in rtl_433's Proflame2 decoder. The proflame2_mc() function writes data to a fixed 7-byte stack buffer without validating input length. Attackers can send more than seven valid Manchester-coded words via crafted OOK radio signals or malformed signal files, causing the buffer to overflow. This corrupts stack memory and may enable control-flow hijacking if stack canaries are disabled.

Detection Guidance

To detect this vulnerability, monitor rtl_433 for crashes or abnormal behavior when processing Proflame2 signals. Use AddressSanitizer during compilation to detect stack buffer overflows. Check logs for SIGABRT crashes, especially on systems without stack canaries. Test with crafted signal files or OOK radio signals exceeding seven Manchester-coded words.

Impact Analysis

This vulnerability allows nearby attackers to crash rtl_433 via DoS if stack canaries are enabled. Without canaries, attackers could potentially execute arbitrary code by sending malicious radio signals or files. Systems decoding Proflame 2 remote signals are at risk, especially those using vulnerable versions (21.12 to 25.12).

Mitigation Strategies

Immediately upgrade rtl_433 to the latest patched version (post-25.12) to apply the bounds checking fix in proflame2_mc. If upgrading is not possible, disable the Proflame2 decoder by removing or renaming the proflame2.c file. Monitor network traffic for suspicious OOK radio signals targeting 314.973 KHz. Apply stack canaries if compiling from source to mitigate potential RCE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart