Description
rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| merbanan | rtl_433 | 21.12 – ≤ 25.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rtl-433 | No fix yet | — |
| Debian 13 | rtl-433 | No fix yet | — |
| Debian 12 | rtl-433 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rtl-433 | No fix yet | — |
| Ubuntu 26.04 LTS | rtl-433 | No fix yet | — |
| Ubuntu 24.04 LTS | rtl-433 | No fix yet | — |
| Ubuntu 22.04 LTS | rtl-433 | No fix yet | — |
| Ubuntu 20.04 LTS | rtl-433 | No fix yet | — |
References
- https://github.com/merbanan/rtl_433/issues/3739 issue-tracking
- https://github.com/merbanan/rtl_433/pull/3740 patch issue-tracking
- https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186 patch
- https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95 technical-description
- https://github.com/merbanan/rtl_433 product
- VulnCheck Advisory: rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder third-party-advisory