Executive brief
RTKLIB is an open-source program package for standard and precise positioning with GNSS (Global Navigation Satellite System). A vulnerability in how it processes satellite data files could allow an attacker to crash applications using this library, such as rnx2rtkp and RTKPOST, by providing a specially crafted file. This could lead to a denial of service, interrupting precise positioning and navigation operations.
Technical details
A heap-based buffer overflow exists in RTKLIB versions up to and including 2.4.3 within the readrnxobsb function in src/rinex.c. The vulnerability is caused by a failure to properly validate or 'clamp' the satellite count values provided in RINEX epoch headers. By crafting a RINEX file that declares more than 64 satellites per epoch, an attacker can trigger heap buffer overflow writes and out-of-bounds stack reads. This typically results in a crash (Denial of Service) of applications linked against the library, such as rnx2rtkp and RTKPOST. Exploitation requires the victim to open or process a malicious RINEX file.
Affected products
- tomojitakasu RTKLIB through 2.4.3
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory