CVE-2025-34450: Rtl_433 Buffer Overflow Vulnerability

CVE-2025-34450 Overview

CVE-2025-34450 is a stack-based buffer overflow in merbanan/rtl_433, an open-source program for decoding radio transmissions from devices on the ISM bands. The flaw resides in the parse_rfraw() function in src/rfraw.c and affects versions up to and including 25.02, prior to commit 25e47f8. When the application processes crafted or oversized raw RF input, it writes past the bounds of a fixed-size stack buffer, leading to memory corruption or process termination. The issue is tracked under [CWE-121] (Stack-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write).

Critical Impact
An attacker supplying malicious raw RF test data can corrupt stack memory in rtl_433, causing denial of service and, depending on the build configuration and platform mitigations, potential code execution.

Affected Products

merbanan/rtl_433 versions up to and including 25.02
All builds prior to commit 25e47f8
Downstream packages and distributions shipping vulnerable rtl_433 binaries

Discovery Timeline

2025-12-18 - CVE-2025-34450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34450

Vulnerability Analysis

The parse_rfraw() function in src/rfraw.c parses raw RF pulse data into an internal pulse_data_t structure. The structure stores pulse samples in a fixed-size array bounded by the PD_MAX_PULSES constant. The pre-patch parser increments data->num_pulses while iterating through user-supplied input without verifying that the index remains within the array. Supplying input that produces more pulses than PD_MAX_PULSES writes past the end of the stack-allocated buffer.

A second write path compounds the issue. After the initial parse, the function expands a repeat block by calling memcpy into &data->pulse[data->num_pulses]. Without a bounds check against PD_MAX_PULSES, a large repeats value or a high pkt_pulses count copies attacker-controlled bytes beyond the buffer. The result is adjacent stack memory corruption, including saved frame pointers and return addresses on architectures without sufficient compiler hardening.

Root Cause

The root cause is missing bounds enforcement on the data->num_pulses index and on the repeat-expansion memcpy destination. The parser trusted that input length would not exceed PD_MAX_PULSES, an assumption that does not hold for crafted RF raw strings.

Attack Vector

Exploitation requires local delivery of crafted RF raw test data to rtl_433, either through command-line arguments, a file passed to the decoder, or a pipeline that feeds RF samples into the binary. The vulnerability does not require authentication or user interaction beyond invoking rtl_433 against the malicious input. Successful exploitation crashes the process. Code execution depends on whether the build was compiled with stack canaries, ASLR, and non-executable stack protections.

            data->num_pulses++;
            pulse_needed = true;
        }
+        // abort reading if the pulse data array is full
+        if (data->num_pulses >= PD_MAX_PULSES) {
+            break;
+        }
    }
    //data->gap[data->num_pulses - 1] = 3000; // TODO: extend last gap?

+    // expand reapeats as long as the pulse data array has enough space
    unsigned pkt_pulses = data->num_pulses - prev_pulses;
    for (int i = 1; i < repeats && data->num_pulses + pkt_pulses <= PD_MAX_PULSES; ++i) {
        memcpy(&data->pulse[data->num_pulses], &data->pulse[prev_pulses], pkt_pulses * sizeof (*data->pulse));

Source: GitHub Commit 25e47f8 — the patch adds an early break when data->num_pulses reaches PD_MAX_PULSES and bounds the repeat-expansion loop with the same limit.

Detection Methods for CVE-2025-34450

Indicators of Compromise

Unexpected segmentation faults or SIGABRT terminations of the rtl_433 process, particularly with stack-smashing detected messages in stderr or system logs
Core dumps generated by rtl_433 containing oversized raw RF input strings in argv or referenced files
Presence of rtl_433 binaries on hosts reporting a version of 25.02 or earlier, verifiable with rtl_433 -V

Detection Strategies

Inventory hosts running rtl_433 and compare installed versions against the fixed commit 25e47f8
Monitor process telemetry for rtl_433 crashes followed by automatic restarts, which can indicate exploitation attempts or fuzzing
Audit shell history, scheduled tasks, and service definitions for rtl_433 invocations consuming external RF capture files

Monitoring Recommendations

Enable core dump collection on systems running rtl_433 to capture forensic evidence of overflow triggers
Forward syslog and journald entries for rtl_433 to a central log platform and alert on crash patterns
Track package update status for distributions that bundle rtl_433 so that downstream fixes are applied promptly

How to Mitigate CVE-2025-34450

Immediate Actions Required

Upgrade rtl_433 to a build that includes commit 25e47f8 or any later release after 25.02
Restrict execution of rtl_433 to trusted users and remove the binary from systems where it is not required
Validate the integrity of any RF capture files before processing them with rtl_433

Patch Information

The fix is delivered in GitHub commit 25e47f8, referenced from merbanan/rtl_433 issue #3375. Additional technical context is published in the Marlink Cyber security advisory and the VulnCheck advisory. Rebuild from source against the patched tree or wait for an updated distribution package.

Workarounds

Avoid passing untrusted or attacker-controlled raw RF test strings to rtl_433 until the patched version is installed
Run rtl_433 under a restricted, non-privileged service account with minimal filesystem access
Compile rtl_433 with stack protector (-fstack-protector-strong), -D_FORTIFY_SOURCE=2, and position-independent executables to reduce exploitation impact

bash

# Verify installed rtl_433 version and rebuild from patched source
rtl_433 -V
git clone https://github.com/merbanan/rtl_433.git
cd rtl_433
git checkout 25e47f8
mkdir build && cd build
cmake -DCMAKE_C_FLAGS="-fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE" ..
make -j$(nproc)
sudo make install