CVE-2026-54634: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-54634 is a dual vulnerability in Hamlib's rigctld daemon affecting the send_raw command handler, comprising a stack out-of-bounds write (CWE-787) and an uninitialized memory disclosure (CWE-908). It affects all Hamlib versions prior to 4.7.2 and was disclosed on September 17, 2026, with the GitHub Security Advisory (GHSA-gpcq-c37x-pr46) originally published June 7, 2026. The vulnerability is exploitable by any unauthenticated remote attacker with network access to TCP port 4532 under the default no-password configuration. It carries a CVSS v3.1 base score of 7.3 (High) (GitHub Advisory, Feedly).

The vulnerability has two distinct root causes in the send_raw command handler. First, in tests/rigctl_parse.c:5956, the function rigctl_send_raw() declares a 200-byte stack buffer (buf[200]) and sets buf_len = 200, but when the CR terminator path is taken, buf_len is never reduced, causing the NUL-termination line buf[buf_len + 1] = 0 to write to buf[201] — one byte past the end of the array (CWE-787). Second, in src/rig.c:8976, rig_send_raw() uses memcpy(reply, buf, reply_len - 1) (copying 199 bytes) instead of memcpy(reply, buf, nbytes) (copying only the actual received bytes), causing up to 198 bytes of uninitialized stack memory — potentially containing return addresses, saved registers, and local variables — to be transmitted to the remote client (CWE-908). Both flaws are triggered by a single unauthenticated TCP command (\send_raw CR A\n) to port 4532, and are confirmed by AddressSanitizer at runtime (GitHub Advisory, Commit 587f7bb, Commit a3a7f00).

Successful exploitation can result in denial of service (daemon crash via stack corruption or ASan abort), information disclosure of up to 198 bytes of uninitialized stack memory per request (weakening ASLR by exposing return addresses and saved registers), and potential for further exploitation through stack memory corruption that could enable control flow hijacking. The affected component, rigctld, is an installed system binary (not a demo utility) that listens on TCP port 4532 with no authentication by default, meaning any network-accessible instance is exposed without additional preconditions (GitHub Advisory).

A public proof-of-concept (PoC) Python script and Dockerfile are included in the GitHub Security Advisory, making exploitation straightforward for any attacker with network access to port 4532. No authentication is required under the default rigctld configuration. The EPSS score is currently 0.0, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible hosts running rigctld on TCP port 4532 using tools like Shodan (port:4532) or Nmap (nmap -p 4532 <target>).
2. Verify target: Attempt a TCP connection to port 4532; rigctld accepts connections without authentication by default and does not present a login prompt.
3. Send malicious payload: Transmit the single command \send_raw CR A\n over the TCP connection. The CR argument sets the terminator byte to 0x0d while leaving buf_len at 200 unreduced; A is a one-byte payload sent to the rig.
4. Trigger OOB write: The rigctl_send_raw() function executes buf[buf_len + 1] = 0, writing a NUL byte to buf[201] — one byte past the 200-byte stack buffer — corrupting adjacent stack memory. On ASan builds, this aborts the daemon immediately.
5. Harvest uninitialized memory: On non-ASan production builds, rig_send_raw() echoes back 1 byte from the rig and then memcpy(reply, buf, reply_len - 1) copies 199 bytes (198 uninitialized) into the caller's buffer, which is transmitted to the attacker via fprintf(fout, "%s\n", buf).
6. Analyze leaked data: Inspect the raw response bytes for non-null values after the first byte; these represent uninitialized stack data including potential return addresses and saved registers useful for defeating ASLR in further exploitation (GitHub Advisory).

• Network: Unexpected TCP connections to port 4532 from external or untrusted IP addresses; repeated short connections to rigctld from a single source.
• Network: TCP payloads containing the string \send_raw CR followed by a short argument on port 4532.
• Logs: rigctld process crash logs or core dumps, particularly with AddressSanitizer output referencing rigctl_parse.c:5956 or rig.c:8976.
• Process: Unexpected termination or restart of the rigctld process; child process crashes with SIGABRT (signal 6) if built with ASan.
• File System: Unexpected core dump files (e.g., core, core.<pid>) in the working directory of rigctld.

Upgrade Hamlib to version 4.7.2 or later, which fixes both vulnerabilities via commits 3e3f78f (changing memcpy(reply, buf, reply_len - 1) to memcpy(reply, buf, nbytes)) and 4717100 (fixing the NUL-termination index from buf[buf_len + 1] to buf[buf_len - 1]). As an immediate workaround, restrict network access to TCP port 4532 using firewall rules to allow only trusted hosts, and enable authentication by launching rigctld with the -A/--password flag. OpenSUSE security updates addressing this CVE have also been published for downstream users (GitHub Release 4.7.2, OpenSUSE Advisory).

The vulnerability was reported by researcher min8282 from EQSTLab and published via GitHub's security advisory process. OpenSUSE issued security announcements for their distributions following the disclosure. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory, OpenSUSE Advisory).