CVE-2026-54634

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54634
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54634.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54634
Aliases
  • GHSA-gpcq-c37x-pr46
Downstream
Related
Published
2026-09-17T21:52:51Z
Modified
2026-09-20T11:46:45Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Hamlib: rigctld `send_raw` Stack Out-of-Bounds Write and Uninitialized Memory Disclosure
Details

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787",
        "CWE-908"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54634.json"
}
References

Affected packages

Git / github.com/hamlib/hamlib

Affected ranges

Type
GIT
Repo
https://github.com/hamlib/hamlib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e3f78fc7732a4ce0da97b7a86d6d9fd9bd117c4
Fixed
47171005bf041f520bb134edf796b9f6fc27e6bf
Fixed
587f7bb2c6442e36ed5b6021f6ee9951daf1576b
Fixed
a3a7f00d759edadbe195d112dc89006ae8db146e
Fixed
40f63488fe0bd751b147f48d62fd217bf53713a0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*
4.7.0
4.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54634.json"