CVE-2026-78136: CHIRP Radio Programming RCE Vulnerability

CVE-2026-78136 Overview

CVE-2026-78136 is a code injection vulnerability [CWE-95] in chirpmyradio CHIRP, an open-source radio programming utility. The flaw exists in the _clean_tmode function within drivers/kenwood_itm.py and allows eval injection through crafted CSV data. An attacker who convinces a user to open a malicious image or CSV file can achieve local code execution in the context of the CHIRP process. The issue was fixed in commit 39178db.

Critical Impact
Successful exploitation results in arbitrary code execution on the victim's system with the privileges of the user running CHIRP, requiring only that the user open a crafted radio image file.

Affected Products

chirpmyradio CHIRP versions prior to commit 39178db
The kenwood_itm driver module (chirp/drivers/kenwood_itm.py)
CSV import functionality inherited from generic_csv

Discovery Timeline

2026-08-23 - CVE-2026-78136 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78136

Vulnerability Analysis

CHIRP parses radio image and CSV files to populate memory channel data across dozens of transceiver drivers. The kenwood_itm driver's _clean_tmode routine processed tone mode values from CSV input without adequate validation. Because the parsing path reached a Python eval-style evaluation of untrusted content, crafted field values in a CSV or image file could execute Python expressions when a user imported the file.

The vulnerability requires local file interaction. The victim must open a malicious .img or .csv file in CHIRP. Once loaded, the driver processes attacker-controlled fields during channel parsing, which triggers the injection.

Root Cause

The root cause is unsafe evaluation of externally supplied data during CSV field cleaning in _clean_tmode. Digital-Coded Squelch (DCS) tone parsing in the Kenwood ITM driver did not constrain the polarity character or numeric fields, allowing a specially formatted selcall value to propagate into a dynamic evaluation context [CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code].

Attack Vector

Exploitation is local and user-interaction dependent. An attacker distributes a crafted CHIRP radio image or CSV file, typically shared through community forums, email, or file-sharing sites focused on amateur radio programming. When the target imports the file, the malicious payload embedded in a tone-mode field is evaluated by the driver, yielding arbitrary Python execution.

python

# Patch excerpt: chirp/drivers/kenwood_itm.py
 import logging
 
 from chirp import chirp_common, errors, directory
+from chirp import kenwood_tone
 from chirp.drivers import generic_csv
 
 LOG = logging.getLogger(__name__)

python

# Patch excerpt: chirp/kenwood_tone.py - DCS polarity handling
         try:
             val = int(selcall[1:4])
             pol = selcall[4]
+            if pol == 'I':
+                pol = 'R'
             return 'DTCS', val, pol
         except (ValueError, IndexError):
             raise ValueError(

Source: GitHub Commit 39178db. The patch moves DCS tone parsing into a dedicated kenwood_tone module and normalizes the polarity character, removing the code path that fed untrusted data into evaluation.

Detection Methods for CVE-2026-78136

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running CHIRP (for example python.exe launching cmd.exe, powershell.exe, or /bin/sh).
CHIRP .img or .csv files received from untrusted sources containing unusual characters or Python syntax in tone or channel fields.
Outbound network connections initiated by the CHIRP process to non-standard hosts shortly after file import.

Detection Strategies

Hunt for process lineage where a Python or CHIRP process spawns interactive shells or scripting hosts on user endpoints.
Inspect CSV and IMG artifacts on endpoints for embedded Python constructs such as __import__, os.system, or subprocess references in fields that should contain tone codes.
Alert on file modifications or new executable drops in user profile directories immediately following CHIRP execution.

Monitoring Recommendations

Enable command-line and process-creation logging on workstations where CHIRP is installed to capture suspicious child processes.
Monitor file downloads with .img and .csv extensions originating from amateur radio forums and mailing lists.
Correlate CHIRP process telemetry with outbound network activity to identify staging or command-and-control behavior.

How to Mitigate CVE-2026-78136

Immediate Actions Required

Update CHIRP to a build that includes commit 39178db or later.
Do not open CHIRP .img or .csv files received from untrusted or unverified sources.
Inventory endpoints where CHIRP is installed and prioritize patching those systems.

Patch Information

The fix is available in the upstream repository at kk7ds/chirp commit 39178db. The patch introduces a dedicated kenwood_tone module and corrects DCS parsing so that polarity values are normalized instead of evaluated. A proof-of-concept demonstrating code execution through a malicious image file is published at the CHIRP Code Execution PoC repository.

Workarounds

Restrict CHIRP usage to files generated locally or sourced from trusted, verified authors until the patched version is deployed.
Run CHIRP under a low-privilege user account without administrative rights to limit the impact of code execution.
Isolate radio-programming workstations from sensitive network segments and require offline transfer of image files.

bash

# Verify the installed CHIRP build includes the fix commit
cd /path/to/chirp
git log --oneline | grep 39178db

# Or upgrade via pip to the latest release
pip install --upgrade chirp