CVE-2026-117609
rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.
| CWE | CWE-121 |
| Vendor | merbanan |
| Product | rtl_433 |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for merbanan rtl_433
Be the first to know when new high vulnerabilities affecting merbanan rtl_433 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
merbanan / rtl_433
21.12 ≤ 25.12
References
github.com: https://github.com/merbanan/rtl_433/issues/3739 github.com: https://github.com/merbanan/rtl_433/pull/3740 github.com: https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186 github.com: https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95 github.com: https://github.com/merbanan/rtl_433 vulncheck.com: https://www.vulncheck.com/advisories/rtl-433-through-25.12-stack-based-buffer-overflow-via-proflame-2-decoder
Credits
Hamza Ghaffari Hamza Ghaffari