CVE-2026-122992 PUBLISHED

Assigner: mitre
Reserved: 05.11.2026 Published: 05.11.2026 Updated: 05.11.2026

In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	G4KLX
Product	DStarGateway
Versions	Default: unaffected affected from bd3b8650c41d3537c2af1d2d32dcb5b9f2a1a754 to 7b75de605dca542a2953dd74c16f0eac96a8944e (excl.)

References

https://github.com/g4klx/DStarGateway
https://github.com/F4FXL/DStarGateway/pull/71
https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

Problem Types

CWE-191 Integer Underflow (Wrap or Wraparound) CWE