FuzzingLabs found four memory-corruption bugs in RTKLIB, the open-source library used for Real-Time Kinematic GNSS positioning. RTK corrects satellite positioning to centimeter accuracy by comparing a receiver against a base station.1
Attack surface
RTKLIB parses correction streams in the RTCM3 format, often delivered over the internet through NTRIP casters, and observation files in the RINEX format. Each bug is reachable from a single crafted RTCM3 message or RINEX file.1
Findings
One is an out-of-bounds write. RTCM3 type-1033 messages carry five 8-bit length fields for antenna and receiver descriptors, and the decoder copies up to 255 bytes into 64-byte buffers without checking. The other three are out-of-bounds reads in the SSR, epoch-count, and observation-code paths. All four were reported upstream as RTKLIB issues #796 to #799.1