CVE-2026-117609
High
Description
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.
SeverityHigh
CVSS7.1
Exploit probability—
ProductMerbanan Rtl
PublishedOct 28, 2026
First seenOct 28, 2026
Weakness typeCWE-121CWE-121
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| merbanan rtl_433 | 21.12 ≤ v ≤ 25.12 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.