Integer Underflow Vulnerability in DStarGateway by G4KLX and F4FXL
CVE-2026-122992

9.2CRITICAL

Key Information:

Vendor

G4klx

Status
Dstargateway
Vendor
CVE Published:
5 November 2026

What is CVE-2026-122992?

DStarGateway by G4KLX and F4FXL has a vulnerability found in APRSUtils.cpp, affecting its handling of the dstarCallsignToAPRS function. An integer underflow occurs when an empty RS-MS1A sender field is processed, leading to potential security risks. This issue highlights the importance of validating input data and ensuring that software handles edge cases correctly to prevent unintended behavior.

Affected Version(s)

DStarGateway bd3b8650c41d3537c2af1d2d32dcb5b9f2a1a754 < 7b75de605dca542a2953dd74c16f0eac96a8944e

References

https://github.com/g4klx/DStarGateway
https://github.com/F4FXL/DStarGateway/pull/71
https://github.com/F4FXL/DStarGateway/blob/7b75de605dca54...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.