CVE-2026-122992: Integer Underflow
Published Nov 5, 2026
·Updated
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.
Event History
Nov 5, 2026
CVE Published
via MITRE·02:36 AM
Data Sourced
via MITRE·02:36 AM
DescriptionWeakness
Data Sourced
via NVD·03:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
G4KLX DStarGateway and F4FXL DStarGateway versions before commit 7b75de6 are affected. The issue is in dstarCallsignToAPRS in APRSUtils.cpp.
2
What input is required to trigger the flaw?
An attacker needs to supply an RS-MS1A sender field that is empty. The vulnerability results from an integer underflow while processing that field.
3
What is the recommended remediation?
Update to a version containing commit 7b75de6 or later. The provided data does not identify an alternative mitigation for deployments that cannot update immediately.