UBUNTU-CVE-2026-117609: Buffer Overflow

Published Oct 28, 2026

Updated

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Affected Software

5 affected components

ubuntu/rtl-433*

Event History

Oct 28, 2026

CVE Published

via OSV·03:17 AM

Data Sourced

via OSV·03:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

When does this issue present a control-flow hijacking risk rather than only a crash?

The reported control-flow hijacking risk applies to builds without stack canaries. On affected builds, the overflow can corrupt stack memory; the provided information also states that rtl_433 can be crashed.

Is physical proximity required to trigger the vulnerable parsing path?

No. A nearby attacker can transmit a crafted OOK radio signal, but a crafted signal file can also supply the malicious input.

UBUNTU-CVE-2026-117609: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

When does this issue present a control-flow hijacking risk rather than only a crash?

Is physical proximity required to trigger the vulnerable parsing path?

Company

Resources

Contact

Frequently Asked Questions

When does this issue present a control-flow hijacking risk rather than only a crash?

Is physical proximity required to trigger the vulnerable parsing path?