{"id":"CVE-2026-122992","title":"In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.","summary":"In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.","severity":"critical","cvss":9.2,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","cvssSource":"cna","cwe":["CWE-191"],"vendor":"G4KLX","product":"DStarGateway","affected":["DStarGateway >= bd3b8650c41d3537c2af1d2d32dcb5b9f2a1a754 < 7b75de605dca542a2953dd74c16f0eac96a8944e"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T02:36:35.657Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122992","references":[{"url":"https://github.com/g4klx/DStarGateway"},{"url":"https://github.com/F4FXL/DStarGateway/pull/71"},{"url":"https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.693Z","epss":0.00318,"epssPercentile":0.24936,"slug":"CVE-2026-122992","body":"## Overview\n\nIn G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.\n\n## Affected\n\n- `DStarGateway >= bd3b8650c41d3537c2af1d2d32dcb5b9f2a1a754 < 7b75de605dca542a2953dd74c16f0eac96a8944e`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":50.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}