External risk intelligence

DStarGateway Integer Underflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-122992

DStarGateway is used to link amateur radio stations over the internet. While it functions as a gateway, these deployments are typically private, hobbyist-run systems rather than general-purpose, internet-facing public web services or enterprise edge gateways, making widespread public internet exposure less common than typical commercial network appliances.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a vulnerability in DStarGateway software that could allow an attacker to disrupt the system's ability to handle specific incoming data. The primary concern is confirming if our organization utilizes this particular software, as the potential impact is linked to the availability of the gateway service.

Software allows bad data to crash it.
Confirm if this specific amateur radio software is used.
Assess relevance and exposure to our operations.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted data to an exposed DStarGateway instance. The vulnerability lies within the `dstarCallsignToAPRS` function, which processes sender information. If an attacker provides an empty sender field, it can trigger an integer underflow, potentially leading to system compromise.

Requires unauthenticated network access.
Triggered by an empty sender field.
Risk of denial of service or code execution.

Live Threat

Current exploitation, exposure, and threat context

An integer underflow vulnerability in the DStarGateway software could allow an attacker to disrupt the service's ability to process incoming data when an empty sender field is provided in an RS-MS1A message. This could lead to a denial of service condition for the gateway.

Service availability.
Malformatted network input.
Gateway disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in DStarGateway could impact teams responsible for amateur radio network infrastructure. The first practical step is to identify all DStarGateway instances, assess their exposure and criticality, and locate the individuals managing them to plan remediation based on risk.

Identify affected technology owners.
Verify network reachability and criticality.
Coordinate with system maintainers for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DStarGateway?

DStarGateway is software used by amateur radio enthusiasts to bridge digital voice and data communications. It acts as a gateway that links local radio stations to the wider internet, allowing operators to route traffic between disparate systems. It is primarily managed by hobbyist communities to support D-STAR radio networks.

What does CVE-2026-122992 mean for my system?

This vulnerability is an integer underflow, categorized as CWE-191. It happens when software performs a mathematical calculation that results in a value smaller than the system can represent. In this case, when the gateway processes data, a specific logic error occurs, which can cause the service to crash or behave unexpectedly.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted RS-MS1A network message containing an empty sender field to the gateway. The system's attempt to process this missing data in the dstarCallsignToAPRS function causes the underflow. Normal, properly formatted radio messages do not trigger this error.

Is my DStarGateway deployment relevant?

According to Halo Surface Signal, these gateways are usually private, hobbyist-run systems rather than standard public web services. While the vulnerability is network-accessible, the risk depends on whether your specific instance is reachable from the public internet versus restricted to internal or trusted network segments.

What should I do to secure my DStarGateway?

First, locate all active DStarGateway installations in your infrastructure and identify the maintainers. Once identified, verify if the systems are reachable over the internet. Coordinate with your team to review the software status and plan to update to a version beyond the affected commit to resolve the underlying code flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.