Read the docs
TI-2026-85332 Aliases CVE-2026-122992GHSA-qj3v-fq33-546m

DStarGateway integer underflow via empty RS-MS1A sender field

Priority MEDIUM 40CWE-191Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6 are affected. The function dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow (CWE-191) triggered by an empty RS-MS1A sender field. An unauthenticated remote attacker can cause a denial of service by sending a crafted RS-MS1A message.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.

Why it matters now

EPSS 0.00318 24th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

No affected products listed by the sources yet.

Remediation

Update G4KLX DStarGateway and F4FXL DStarGateway to commit 7b75de6 or a later build, since earlier builds are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-122992
  2. 2026-11-05 Alias added: GHSA-qj3v-fq33-546m

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences