Read the docs
TI-2026-81654 Aliases CVE-2026-117609GHSA-mq9h-jmwj-r2r4

Stack-based buffer overflow in rtl_433 Proflame 2 decoder

Priority LOW 31CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

rtl_433 from 21.12 through 25.12 contains a stack-based buffer overflow (CWE-121) in the proflame2_mc() function. The function writes past a 7-byte stack buffer when a signal contains more than seven valid Manchester-coded words. A nearby attacker can send a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, which can enable control-flow hijacking on builds without stack canaries.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
merbananrtl_43321.12 – 25.12—No fix listedCNA
  • rtl_433 Vendormerbanan Affected 21.12 – 25.12 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rtl_433.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-117609
  2. 2026-10-28 Alias added: GHSA-mq9h-jmwj-r2r4
  3. 2026-10-28 CISA SSVC decision points changed
  4. 2026-10-28 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences