Loading story…
A critical vulnerability tracked as CVE-2026-56786 affects RTKLIB through version 2.4.3. The flaw is an out-of-bounds write in the decode_type1033 function, where length counters are not properly clamped to destination buffer sizes. A crafted RTCM3 type-1033 message with a valid CRC can trigger an overflow of up to 191 bytes into fixed 64-byte descriptor fields, corrupting adjacent members of the rtcm_t object.
The issue is considered remotely exploitable when an attacker can control an NTRIP or serial RTCM3 correction stream, potentially leading to arbitrary code execution or denial of service. The vulnerability has been rated 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. Recommended mitigations include updating RTKLIB, applying the vendor patch for decode_type1033, validating buffer lengths before writes, and sanitizing input length counters.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical out-of-bounds write vulnerability affecting RTKLIB through version 2.4.3 was disclosed as CVE-2026-56786. The flaw in decode_type1033 can be triggered with a crafted RTCM3 type-1033 message and may enable denial of service or arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical heap-based buffer overflow** in FreeRDP affects versions through `3.27.1`, allowing an unauthenticated attacker to trigger memory corruption before authentication when **RDP Standard Security** is enabled. The flaw is in `crypto_rsa_common()` in `libfreerdp/crypto/crypto.c`, where `BN_bn2bin()` writes decrypted modular-exponentiation output into a caller-supplied buffer before verifying that the data fits, creating an out-of-bounds heap write condition. An attacker can exploit the issue by sending a crafted RSA ciphertext for the encrypted client random during the RDP handshake. Because the server exposes its RSA public key, the ciphertext can be made to decrypt to data as large as the RSA modulus length—such as `256` bytes with `RSA-2048`—while the target buffer is only `32` bytes, producing roughly `224` bytes of attacker-controlled overflow and causing denial of service. The vulnerability is tracked as **`CVE-2026-64620`**, carries a **CVSS v3.1 score of 9.8**, and is fixed in **FreeRDP `3.28.0`**.
Jul 21, 2026
A critical vulnerability (CVE-2025-68615) has been identified in the Net-SNMP `snmptrapd` daemon, which can be exploited by sending a specially crafted packet to cause a buffer overflow and crash the service. The flaw affects versions prior to 5.9.5 and 5.10.pre2, and has been addressed in these patched releases. The vulnerability is remotely exploitable and does not require authentication, making it a significant risk for organizations running affected versions of Net-SNMP. Technical analysis reveals that the vulnerability stems from improper validation of user-supplied data length before copying it to a fixed-length stack-based buffer within the `snmptrapd` service, which listens on UDP port 162 by default. Successful exploitation allows remote attackers to execute arbitrary code in the context of the service account. Net-SNMP has released security updates to mitigate this issue, and users are strongly advised to upgrade to the latest versions to protect their systems.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026