DEBIAN-CVE-2026-56788
RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in getcodepri function when processing unrecognized RINEX observation codes, allowing attackers to trigger denial of service. Crafted RINEX files with unknown observation types cause negative array indexing into the codepris table, resulting in reliable crashes and potential memory disclosure of adjacent global data.
DEBIAN-CVE-2026-56788
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-56788
rtklib
Source reference: /affected/0/package/name
- Affected versions
- 2.4.3.b34+dfsg-1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
rtklib
Source reference: /affected/1/package/name
- Affected versions
- 2.4.3.b34+dfsg-1
Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rtklib",
"purl": "pkg:deb/debian/rtklib?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.4.3.b34+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56788.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rtklib",
"purl": "pkg:deb/debian/rtklib?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"2.4.3.b34+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-56788.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56044 · Revision 1
- Added to Heist Feed
- Publisher date