rtl_433 through version 25.12 contains a stack-based buffer overflow in the proflame2_mc() function that processes Manchester-coded words in the Proflame 2 decoder. By transmitting more than seven valid Manchester-coded words via an OOK radio signal or a crafted signal file, an attacker can overwrite data past a 7-byte stack buffer, corrupting stack memory and potentially enabling control‑flow hijacking on builds that lack stack canaries. The resulting vulnerability exposes the ability to execute arbitrary code on the host running rtl_433.

Only the merbanan rtl_433 project at version 25.12 is affected. This open‑source radio signal decoder, commonly used for interpreting low‑power radio streams, includes the vulnerable Proflame 2 decoder logic in its source code. Users running this exact version, or builds derived from it that compile the unpatched decoder, are at risk.

The CVSS score of 7.1 indicates a high severity for this bug. The exploit requires sending a specially crafted radio burst or supplying a malicious signal file, meaning that an attacker needs proximity or a dedicated signal source; the condition is not fully remote but achievable in physical or near‑field scenarios. Although EPSS data is not yet available and the issue is not listed in the CISA KEV catalog, the potential for code execution on commonly deployed systems means the risk remains significant. As a result, the vulnerability should be treated as a high‑confidence threat pending patch release.