{"id":"UBUNTU-CVE-2026-54634","details":"Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.","modified":"2026-09-23T23:31:22Z","published":"2026-09-17T22:17:00Z","upstream":["CVE-2026-54634"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-54634"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-54634"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/security/advisories/GHSA-gpcq-c37x-pr46"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/587f7bb2c6442e36ed5b6021f6ee9951daf1576b"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/a3a7f00d759edadbe195d112dc89006ae8db146e"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/3e3f78fc7732a4ce0da97b7a86d6d9fd9bd117c4"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/47171005bf041f520bb134edf796b9f6fc27e6bf"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/3e3f78fc7732a4ce0da97b7a86d6d9fd9bd117c4"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/47171005bf041f520bb134edf796b9f6fc27e6bf"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/587f7bb2c6442e36ed5b6021f6ee9951daf1576b"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/commit/a3a7f00d759edadbe195d112dc89006ae8db146e"},{"type":"REPORT","url":"https://github.com/Hamlib/Hamlib/releases/tag/4.7.2"}],"affected":[{"package":{"name":"hamlib","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.15.3-3","1.2.15.3-3.1","1.2.15.3-3.1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.2.15.3-3.1build1","binary_name":"libhamlib-utils"},{"binary_name":"libhamlib2","binary_version":"1.2.15.3-3.1build1"},{"binary_name":"libhamlib2++c2","binary_version":"1.2.15.3-3.1build1"},{"binary_version":"1.2.15.3-3.1build1","binary_name":"libhamlib2-perl"},{"binary_name":"libhamlib2-tcl","binary_version":"1.2.15.3-3.1build1"},{"binary_name":"python-libhamlib2","binary_version":"1.2.15.3-3.1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}},{"package":{"name":"hamlib","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1-7","3.1-7build1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.1-7build1","binary_name":"libhamlib-utils"},{"binary_name":"libhamlib2","binary_version":"3.1-7build1"},{"binary_version":"3.1-7build1","binary_name":"libhamlib2++c2"},{"binary_name":"libhamlib2-perl","binary_version":"3.1-7build1"},{"binary_version":"3.1-7build1","binary_name":"libhamlib2-tcl"},{"binary_version":"3.1-7build1","binary_name":"lua-hamlib2"},{"binary_version":"3.1-7build1","binary_name":"python-libhamlib2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}},{"package":{"name":"hamlib","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-5","3.3-5ubuntu1","3.3-7","3.3-8","3.3-10","3.3-10build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhamlib-utils","binary_version":"3.3-10build1"},{"binary_version":"3.3-10build1","binary_name":"libhamlib2"},{"binary_name":"libhamlib2++c2","binary_version":"3.3-10build1"},{"binary_name":"libhamlib2-perl","binary_version":"3.3-10build1"},{"binary_version":"3.3-10build1","binary_name":"libhamlib2-tcl"},{"binary_name":"lua-hamlib2","binary_version":"3.3-10build1"},{"binary_name":"python3-libhamlib2","binary_version":"3.3-10build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}},{"package":{"name":"hamlib","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0-7","4.0-7build1","4.3.1-1","4.3.1-1build1","4.3.1-1build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libhamlib++4","binary_version":"4.3.1-1build2"},{"binary_version":"4.3.1-1build2","binary_name":"libhamlib-perl"},{"binary_name":"libhamlib-utils","binary_version":"4.3.1-1build2"},{"binary_name":"libhamlib2-perl","binary_version":"4.3.1-1build2"},{"binary_name":"libhamlib2-tcl","binary_version":"4.3.1-1build2"},{"binary_version":"4.3.1-1build2","binary_name":"libhamlib4"},{"binary_name":"lua-hamlib","binary_version":"4.3.1-1build2"},{"binary_name":"lua-hamlib2","binary_version":"4.3.1-1build2"},{"binary_name":"python3-hamlib","binary_version":"4.3.1-1build2"},{"binary_name":"python3-libhamlib2","binary_version":"4.3.1-1build2"},{"binary_version":"4.3.1-1build2","binary_name":"tcl-hamlib"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}},{"package":{"name":"hamlib","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.5-2","4.5.5-2build1","4.5.5-3","4.5.5-3build2","4.5.5-3.2build1","4.5.5-3.2build2"],"ecosystem_specific":{"binaries":[{"binary_version":"4.5.5-3.2build2","binary_name":"libhamlib++4t64"},{"binary_name":"libhamlib-perl","binary_version":"4.5.5-3.2build2"},{"binary_name":"libhamlib-utils","binary_version":"4.5.5-3.2build2"},{"binary_name":"libhamlib4t64","binary_version":"4.5.5-3.2build2"},{"binary_name":"lua-hamlib","binary_version":"4.5.5-3.2build2"},{"binary_name":"python3-hamlib","binary_version":"4.5.5-3.2build2"},{"binary_version":"4.5.5-3.2build2","binary_name":"tcl-hamlib"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}},{"package":{"name":"hamlib","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/hamlib?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.2-1build1","4.6.2-1build2","4.6.5-5","4.6.5-5build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhamlib++4t64","binary_version":"4.6.5-5build1"},{"binary_name":"libhamlib-perl","binary_version":"4.6.5-5build1"},{"binary_name":"libhamlib-utils","binary_version":"4.6.5-5build1"},{"binary_name":"libhamlib4t64","binary_version":"4.6.5-5build1"},{"binary_name":"lua-hamlib","binary_version":"4.6.5-5build1"},{"binary_name":"python3-hamlib","binary_version":"4.6.5-5build1"},{"binary_name":"tcl-hamlib","binary_version":"4.6.5-5build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54634.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}