CVE-2026-54634 Details
Description
Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.
A stack buffer overflow vulnerability has been identified in Hamlib versions prior to 4.7.2. The issue arises in the 'rigctld' daemon, specifically within the 'send_raw' command handler. This vulnerability allows an unauthenticated remote attacker to send a single TCP command that triggers both a stack out-of-bounds write and the disclosure of uninitialized memory. The out-of-bounds write occurs when the command is processed, writing a null byte past the end of a 200-byte stack buffer. This can crash the daemon or corrupt adjacent stack memory. Simultaneously, the command exploitation leaks up to 198 bytes of uninitialized stack data to the client, which could be exploited to bypass security measures such as Address Space Layout Randomization (ASLR).
Users are advised to update to Hamlib version 4.7.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hamlib | >= 5.0.0~git |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |