CVE-2026-122992 in DStarGateway
Summary
by MITRE • 11/05/2026
In G4KLX DStarGateway and F4FXL DStarGateway before 7b75de6, dstarCallsignToAPRS in APRSUtils.cpp has an integer underflow via an empty RS-MS1A sender field.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified involves a critical logic error within the G4KLX and F4FXL DStarGateway software projects, specifically located in the dstarCallsignToAPRS function found in APRSUtils.cpp. This component is responsible for processing Amateur Radio Service (ARS) data associated with Digital Smart Technologies for Amateur Radio (D-STAR) communications to generate Automatic Packet Reporting System (APRS) packets. The core technical flaw stems from an integer underflow condition triggered when the RS-MS1A sender field, which typically contains metadata about the repeater or gateway node originating a transmission, is empty or missing expected data structures. In C++ implementations handling fixed-size buffers and arithmetic operations on unsigned integers, subtracting from zero or performing calculations that expect non-empty input without adequate bounds checking can result in wrapping around to extremely large positive values due to two's complement representation rules.
This integer underflow represents a classic CWE-191 vulnerability type where an arithmetic operation results in a value smaller than the minimum representable value for the data type, leading to unexpected behavior rather than immediate memory corruption in this specific context of string manipulation or buffer sizing logic. When the RS-MS1A field is empty, the code likely attempts to parse or calculate offsets based on expected lengths that are not present. The resulting underflowed integer may then be used as a length parameter for subsequent operations such as memcpy, strcpy, or array indexing within the APRS packet construction routine. This discrepancy between intended logic and actual execution creates an opportunity for anomalous data handling where the system proceeds with invalid assumptions about buffer boundaries or string lengths derived from corrupted arithmetic results.
The operational impact of this vulnerability extends beyond simple parsing errors. If the underflowed value is utilized to determine memory allocation sizes or loop iterations, it can lead to out-of-bounds reads or writes depending on how downstream functions interpret the malformed integer. In network-facing services like D-STAR gateways that process incoming radio traffic and convert it for internet-based APRS distribution, such flaws can potentially allow an attacker who controls the input stream to influence memory layout or trigger denial of service conditions by causing crashes in the gateway software. Furthermore, if the underflow leads to incorrect buffer indexing, there is a theoretical risk of information disclosure through out-of-bounds reads or code execution via heap-based exploitation techniques if the vulnerable integer influences pointer arithmetic directly.
From an industry standard perspective, this flaw aligns with CWE-190 Integer Overflow or Wraparound and potentially CWE-787 Out-of-Bounds Write if the underflowed value leads to memory access beyond allocated limits. In terms of attack vectors, it falls under ATT&CK technique T1190 Exploit Public-Facing Application as gateways are often exposed to network traffic from various sources including amateur radio repeaters connected via IP networks. The lack of strict validation on the RS-MS1A field indicates a failure in input sanitization principles where empty or malformed fields should be explicitly handled rather than passed through arithmetic operations that assume valid data presence.
Mitigation strategies require immediate code review and patching to address the root cause within APRSUtils.cpp. Developers must implement explicit checks for null, empty, or invalid states of the RS-MS1A sender field before performing any integer calculations involving its length or content. Utilizing safe string handling libraries that prevent underflow by validating input lengths against expected minimums is essential. Additionally, enabling compiler warnings related to signed/unsigned mismatch and arithmetic overflow can help detect similar issues during development. For deployed systems, applying the patch version 7b75de6 or later resolves this issue by correcting the logic flow to handle empty fields gracefully without triggering underflow conditions. Network-level defenses such as intrusion detection signatures monitoring for anomalous D-STAR packet structures with missing metadata may also provide limited visibility into exploitation attempts while patches are being applied.