PT-2025-52352 · Merbanan+1 · Rtl 433+1

Vlatko Kosturjak · Published 2025-12-18 · Updated 2025-12-31 · CVE-2025-34450

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions merbanan/rtl 433 versions up to and including 25.02 and prior to commit 25e47f8

Description The software contains a stack-based buffer overflow in the parse rfraw() function, located in src/rfraw.c. Processing crafted or excessively large raw RF input data can cause the application to write beyond the bounds of a stack buffer, leading to memory corruption or a crash. This can result in a denial of service and, potentially, further exploitation depending on the environment.

Recommendations Update to a version after commit 25e47f8.

Exploit

Fix

DoS

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2025-34450

Affected Products

Debian

Rtl 433

References · 13

• 🔥 https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-004-rtl_433-rfraw-parse-overflow.md · Exploit
• https://github.com/merbanan/rtl_433/issues/3375 · Patch
• https://github.com/dd32/rtl_433/commit/25e47f8 · Patch
• https://osv.dev/vulnerability/CVE-2025-34450 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-34450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-34450 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-34450 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-34450 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-34450 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-34450 · Security Note
• https://vulncheck.com/advisories/merbanan-rtl-433-stack-based-buffer-overflow · Note
• https://twitter.com/CVEnew/status/2002104279843082749 · Twitter Post
• https://t.me/cveNotify/147356 · Telegram Post