Rtl 433 Project maintains a narrowly scoped software-defined radio decoder primarily used for receiving and analyzing 433 MHz wireless signals from IoT devices, weather stations, and home automation equipment. The vulnerability exposure recurs through memory-handling weakness classes including out-of-bounds writes, off-by-one errors, and stack-based buffer overflows, characteristic of signal-parsing code operating on untrusted RF input with minimal validation. Current severity, exploitation activity, and exposure details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rtl 433 Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-34450HIGH merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw() located in src/rfr | Dec 18, 2025 | 7.8 | 24 | NO | NO |
CVE-2022-25051MEDIUM An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file. | Mar 2, 2022 | 5.5 | 21 | NO | NO |
CVE-2022-25050MEDIUM rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted f | Mar 2, 2022 | 5.5 | 21 | NO | NO |
CVE-2022-27419MEDIUM rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. This vulnerability allows attackers to cause a Denial of Serv | Apr 12, 2022 | 5.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rtl 433 Project.
Media articles that mention a CVE ID that affects a product developed by Rtl 433 Project — matched by CVE ID, not by vendor name.