Hamlib EUVD-2026-82573

Requires network reachability to the rigctld daemon listening on TCP port 4532 running the default no-password configuration (no authentication needed). Exploitation is a single send_raw command with a short payload terminated by a CR. The principal limiting factor is exposure: rigctld is frequently bound to localhost and only reachable remotely when the operator deliberately exposes the port, so realistic attack surface is narrower than AV:N/PR:N alone suggests. No user interaction, special platform, or non-default feature beyond the network-listening daemon is required.

This is a genuine but bounded network-exposed memory-safety issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation, which is corroborated by the description's note that rigctld runs under a default no-password configuration on TCP port 4532. Impact is deliberately scored low across the board (C:L/I:L/A:L, score 7.3): the out-of-bounds NUL write corrupts adjacent stack memory or crashes the daemon (availability + limited integrity), and the oversized copy leaks up to 198 bytes of uninitialized stack (limited confidentiality). No EPSS score, KEV listing, or public POC is present in the input, so this is 'no public exploit identified at time of analysis' - a real but not urgent priority. The most important limiting factor NOT captured in the CVSS vector is that rigctld is commonly bound to localhost and only exposed to the network when the operator deliberately configures it, so the AV:N/PR:N combination overstates typical real-world reachability. Note the fix commit only shows the src/rig.c oversized-copy repair; the OOB-write fix in tests/rigctl_parse.c is in the sibling commits referenced but not shown in the provided diff.

An attacker who can reach an exposed rigctld daemon on TCP 4532 connects without credentials (default no-password mode) and issues a send_raw command with a short payload terminated by CR. This single command simultaneously triggers the out-of-bounds NUL write (crashing the daemon or corrupting stack memory) and the oversized reply copy, returning up to 198 bytes of uninitialized stack data to the attacker. No public exploit code is identified at time of analysis, though the fix commit diff essentially documents the mechanism.