Stack-Based Buffer Overflow in merbanan/rtl_433 parse_rfraw

Publication date: 2025-12-18

Last updated on: 2025-12-18

Assigner: VulnCheck

Description

merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-34450

Affected Vendors & Products

Vendor	Product	Version / Range
merbanan	rtl_433	25.02

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This vulnerability is a stack-based buffer overflow in the parse_rfraw() function of merbanan/rtl_433 software versions up to 25.02 and before a specific commit. When the software processes crafted or very large raw RF input data, it may write data beyond the allocated stack buffer, causing memory corruption or a crash.

Impact Analysis

The vulnerability can cause the application to crash, resulting in a denial of service. Under certain conditions, it may also be exploited further depending on the execution environment and available mitigations, potentially leading to more severe impacts.

Hi! I’m here to help you understand CVE-2025-34450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70