CVE-2025-34450 merbanan/rtl_433 <= 25.02 Stack-based Buffer Overflow
Attackers can cause memory corruption and potential code execution in rtl_433 by providing crafted raw RF input data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-34450?
CVE-2025-34450 is a medium-severity memory corruption vulnerability in merbanan rtl_433, published on 18 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfraw.c. When processing crafted or excessively large raw RF input data, the application may write beyond the bounds of a stack buffer, resulting in memory corruption or a crash. This vulnerability can be exploited to cause a denial of service and, under certain conditions, may be leveraged for further exploitation depending on the execution environment and available mitigations.
Which versions are affected by CVE-2025-34450?
It affects 1 product.
Products include Rtl 433 Project Rtl 433.
How do I fix CVE-2025-34450?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-34450 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34450 exists.
Other vulnerabilities in merbanan rtl_433
Sources
Also known as DEBIAN-CVE-2025-34450, GHSA-h7qg-49w9-4cpx, UBUNTU-CVE-2025-34450.