CVE-2025-34450
📋 TL;DR
A stack-based buffer overflow vulnerability in rtl_433's parse_rfraw() function allows attackers to cause denial of service or potentially execute arbitrary code by sending crafted RF input data. This affects all users running vulnerable versions of rtl_433 software. The vulnerability is present in default configurations when processing raw RF data.
💻 Affected Systems
- rtl_433
📦 What is this software?
Rtl 433 by Rtl 433 Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if exploit bypasses modern mitigations like ASLR and stack canaries.
Likely Case
Application crash and denial of service, disrupting RF monitoring capabilities.
If Mitigated
Application crash with no further impact if modern OS protections (ASLR, stack canaries) are effective.
🎯 Exploit Status
Exploitation requires ability to transmit crafted RF signals within range of the vulnerable device. No public exploit code available at disclosure time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 25e47f8 and later
Vendor Advisory: https://github.com/merbanan/rtl_433/commit/25e47f8
Restart Required: Yes
Instructions:
1. Update rtl_433 to commit 25e47f8 or later. 2. For package managers: Use latest available version. 3. For source builds: git pull and rebuild. 4. Restart any running rtl_433 processes.
🔧 Temporary Workarounds
Disable raw RF data processing
allAvoid using -R flag or similar options that trigger the vulnerable parse_rfraw() function
rtl_433 -c config_file.conf (without -R options)
Network segmentation
allIsolate rtl_433 devices from untrusted networks
🧯 If You Can't Patch
- Disable raw RF data processing options completely
- Implement strict physical security controls around RF monitoring areas
🔍 How to Verify
Check if Vulnerable:
Check rtl_433 version: rtl_433 -V. If version is 25.02 or earlier, or commit hash is before 25e47f8, system is vulnerable.Check Version:
rtl_433 -VVerify Fix Applied:
Verify version shows commit 25e47f8 or later: git log --oneline -1📡 Detection & Monitoring
Log Indicators:
- Segmentation fault crashes in syslog
- Abnormal termination of rtl_433 process
- Core dumps in working directory
Network Indicators:
- Unusual RF signal patterns if monitored
- Sudden cessation of expected RF data streams
SIEM Query:
process_name:"rtl_433" AND (event_type:"crash" OR exit_code:139)🔗 References
- https://github.com/dd32/rtl_433/commit/25e47f8
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-004-rtl_433-rfraw-parse-overflow.md
- https://github.com/merbanan/rtl_433/issues/3375
- https://www.vulncheck.com/advisories/merbanan-rtl-433-stack-based-buffer-overflow
- https://github.com/marlinkcyber/advisories/blob/main/advisories/MCSAID-2025-004-rtl_433-rfraw-parse-overflow.md
