CVE-2026-117609 in rtl_433
Summary
by MITRE • 10/28/2026
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in versions of rtl_433 up through 25.12 represents a critical security flaw rooted in improper boundary checking within the proflame2_mc function. This specific routine is responsible for decoding Manchester-coded radio signals, which are commonly used by various low-power wireless devices such as weather stations and smart home sensors. The core technical issue arises from an insufficient validation of input data length before it is copied into a fixed-size stack buffer that is only seven bytes in capacity. When the function processes incoming signal data, it fails to verify whether the number of valid Manchester-coded words exceeds this strict limit. Consequently, if an attacker transmits or supplies more than seven such words, the copy operation proceeds without bounds checking, leading directly to a stack-based buffer overflow condition where memory adjacent to the intended buffer is overwritten with maliciously crafted data.
From an operational perspective, this vulnerability allows for remote code execution potential via wireless interfaces, which significantly expands the attack surface compared to traditional network-based exploits. An adversary positioned within radio range can transmit a specially constructed On-Off Keying signal or provide a malformed signal file directly to the application. The immediate impact of exploiting this flaw includes the crash of the rtl_433 process due to stack corruption and memory access violations. More critically, on system builds that lack modern mitigations such as stack canaries or non-executable stack protections, an attacker can leverage the overwritten return address or function pointers to hijack control flow. This enables arbitrary code execution with the privileges of the running rtl_433 instance, potentially allowing full compromise of the host system and interception of sensitive data processed by the software.
This flaw aligns closely with Common Weakness Enumeration category CWE-121, which describes a stack-based buffer overflow resulting from copying user-controlled input to a fixed-size stack buffer without adequate bounds checking. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with initial access and privilege escalation via wireless communication channels. The ability to inject crafted radio signals mirrors tactics used in physical proximity attacks where adversaries exploit weak authentication or lack of encryption in IoT protocols. To mitigate these risks, users should immediately upgrade rtl_433 to a version newer than 25.12 where the proflame2_mc function has been patched with proper length validation logic. Additionally, deploying runtime application self-protection mechanisms such as stack canaries and Address Space Layout Randomization is recommended for environments running older versions that cannot be immediately updated. Network segmentation should also be considered to limit exposure of rtl_433 instances to untrusted wireless sources, ensuring that only authorized devices are permitted to communicate with the decoding software.