CVE-2026-117609: rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

Q: Which deployments are realistically exposed?

Deployments that receive nearby OOK radio transmissions or process signal files are exposed. An attacker can target the radio path by transmitting a crafted signal, or the file-processing path by providing a crafted signal file.

Q: What access does an attacker need?

Radio-based exploitation requires the attacker to be nearby enough to transmit the crafted OOK signal. The vulnerability does not require privileges or user interaction; alternatively, the attacker needs a way to have rtl_433 process a crafted signal file.

Q: Is the impact limited to a crash?

No. The overflow can crash rtl_433 and corrupt stack memory. On builds without stack canaries, the corruption can enable control-flow hijacking.

Published Oct 28, 2026

Updated

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Affected Software

1 affected component

rtl_433 rtl_433<=25.12

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are realistically exposed?

Deployments that receive nearby OOK radio transmissions or process signal files are exposed. An attacker can target the radio path by transmitting a crafted signal, or the file-processing path by providing a crafted signal file.

What access does an attacker need?

Radio-based exploitation requires the attacker to be nearby enough to transmit the crafted OOK signal. The vulnerability does not require privileges or user interaction; alternatively, the attacker needs a way to have rtl_433 process a crafted signal file.

Is the impact limited to a crash?

No. The overflow can crash rtl_433 and corrupt stack memory. On builds without stack canaries, the corruption can enable control-flow hijacking.

CVE-2026-117609: rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What access does an attacker need?

Is the impact limited to a crash?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What access does an attacker need?

Is the impact limited to a crash?