{"id":"CVE-2026-117609","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-117609","summary":"rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder","details":"rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and corrupt stack memory, enabling control-flow hijacking on builds without stack canaries.","published":"2026-10-28T02:03:18.083Z","modified":"2026-10-29T02:48:32.009387186Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186","label":"merbanan/rtl_433@f35183a"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-117609.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117609"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rtl-433-through-25.12-stack-based-buffer-overflow-via-proflame-2-decoder"},{"type":"REPORT","url":"https://github.com/merbanan/rtl_433/issues/3739"},{"type":"FIX","url":"https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186"},{"type":"FIX","url":"https://github.com/merbanan/rtl_433/pull/3740"},{"type":"PACKAGE","url":"https://github.com/merbanan/rtl_433"},{"type":"ARTICLE","url":"https://github.com/merbanan/rtl_433/blob/25.12/src/devices/proflame2.c#L46-L95"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-29T02:48:32.009387186Z"}}