CHIRP EUVD-2026-64616

Exploitation requires a user to actively import a crafted CSV file using CHIRP's Kenwood ITM driver - specifically, a file containing a malicious Python expression in the TXSIG or RXSIG columns processed by _clean_tmode in drivers/kenwood_itm.py. The CVSS UI:R metric confirms that exploitation cannot occur without this deliberate user action; no remote or unauthenticated network path exists. PR:N confirms the attacker requires no credentials or privileges - only the ability to deliver the file to the victim and induce import. Exploitation is further constrained to Kenwood ITM format CSV files specifically; other CHIRP driver formats are not affected by this code path. The vulnerability is limited to CHIRP builds prior to commit 39178db on any platform where CHIRP runs.

The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the file-based local attack model: an attacker must deliver a crafted CSV and induce a user to import it, making this a social-engineering-dependent scenario rather than a remotely automatable exploit. The high C/I/A scores are justified by the full arbitrary code execution outcome. No EPSS score was provided in the input data, and the vulnerability is absent from CISA KEV, suggesting exploitation is not yet widespread. The existence of a public proof-of-concept repository (github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile) meaningfully elevates risk for active users, as the technical bar for exploitation is now low for anyone who can socially engineer a file import. CHIRP's user base is predominantly amateur radio hobbyists operating on personal machines; there is no indication of enterprise or critical infrastructure deployment, which limits aggregate impact. The attack is not automatable at scale due to the required user interaction.

An attacker crafts a CHIRP CSV file with a malicious Python expression embedded in the TXSIG or RXSIG column (e.g., __import__('os').system('...')), then distributes it on a ham radio forum or via direct message as a legitimate-looking frequency file. When the victim imports the file through CHIRP's Kenwood ITM driver, eval() executes the embedded expression with the privileges of the CHIRP process. A public proof-of-concept on GitHub demonstrates this technique, lowering the skill threshold for exploitation.