CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote client can send the CR terminator with a short payload to trigger both flaws in one command under the default no-password configuration. The out-of-bounds write can crash the daemon or corrupt adjacent stack memory, while the oversized copy can return up to 198 bytes of uninitialized stack data to the client. This issue is fixed in version 4.7.2.

These are all security issues fixed in the hamlib-4.7.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for hamlib fixes the following issues:

Changes in hamlib:

• Update to 4.7.2:

  • Fix IC-7600/IC-7610 clock commands
  • Icom: Add CWR to modes eligible for DSP filtering
  • Kenwood: New model Hamgeek uSGX
  • Various fixes for Skywatcher, DX-SR8, FT-710, FTX-1, IC-705, X6100
  • rigctld: Fix send_raw stack out-of-bounds write and uninitialized memory CVE-2026-54634 (boo#1268628)
  • rigctld: Fix stack/heap overflow primitive in read_string_generic + auth bypass in rigctld + weak password handling (boo#1268629)

• Update to 4.7.1:

  • Various compiler and portability fixes
  • Fix rig port timeout
  • Fix various FTX-1 meter, level and CTCSS table
  • Add power off capability to Flrig backend
  • Add SWR to supported 'get levels' for K3/K4
  • Add get_split_vfo to TS-850 backend
  • New simplecat backend
  • Fix and generalize clock handling for Icom radios
  • Fix Yaesu attenuator levels and LVL_KEYSPD reinitialization
  • Add new rig model Harris PRC-138
  • Various FT-710 fixes, eespecially handling SH format and RX bandwidth
  • Ensure FT-710 simulator rejects RF command
  • Fix low power calculation for K3/K3S
  • Fix FTX-1 SH bandwidth command in set/get_mode

• Update to 4.7.0:

  • Revamp Kenwood voice memory handler - Fixes TS-890S & TS-990S
  • libusb is now detected using the pkg-config facility.
  • Functions rig_get_conf, rot_get_conf, amp_get_conf deprecated use *_get_conf2() instead
  • rig_set_trn and rig_get_trn deprecated.
  • Many fixes for SWIG binding generation and improved Python support and testing
  • Fix AGC for IC-R75, fix AGC for all Icom rigs
  • New Drake R8 backend
  • New AF6SA WRC rotator backend
  • New Yaesu FTX-1 model support (alpha)
  • Update QRPLabs QMX backend for max serial rate of 230400 bps
  • Updates to Icom IC-F8101
  • New rig model Icom ID-52A/W Plus
  • Fix memory leaks in rigctld and rigctltcp
  • Fix Skywatcher backend for firmware that doesn't echo commands
  • Additional Yaesu FTX-1 capabilities
  • Add extended commands for the IC-7300MK2--
  • Revert updating FLRig model name
  • Add manual pages for rigctltcp, rigtestlibusb, rigtestmcast, and rigtestmcastrx
  • Pause building rigfreqwalk as the code does not align with the required commandline parameters
  • Developer visible changes, code moves and refactoring

• Update to 4.6.5:

  • Update Kenwood CW buffer max message size, fix one byte buffer overrun
  • Fix segmentation Faults