{"id":"UBUNTU-CVE-2026-73149","details":"[GHSA-mh75-5pr3-qv2p: NetRx: out-of-bounds read via unvalidated MsgAudio length]","modified":"2026-08-13T19:30:24.779995050Z","published":"2026-08-13T00:00:00Z","upstream":["CVE-2026-73149"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-73149"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-73149"},{"type":"REPORT","url":"https://github.com/sm0svx/svxlink/security/advisories/GHSA-mh75-5pr3-qv2p"}],"affected":[{"package":{"name":"svxlink","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.08.1-1build1","14.08.1-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libasyncaudio1.3","binary_version":"14.08.1-2"},{"binary_version":"14.08.1-2","binary_name":"libasynccore1.3"},{"binary_name":"libasynccpp1.3","binary_version":"14.08.1-2"},{"binary_name":"libasyncqt1.3","binary_version":"14.08.1-2"},{"binary_version":"14.08.1-2","binary_name":"libecholib1.3"},{"binary_name":"qtel","binary_version":"14.08.1-2"},{"binary_name":"remotetrx","binary_version":"14.08.1-2"},{"binary_name":"svxlink-server","binary_version":"14.08.1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}},{"package":{"name":"svxlink","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.11-2.1","15.11+20171207~git445-380e5333-1","17.12.1-1","17.12.1-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libasyncaudio1.5","binary_version":"17.12.1-2"},{"binary_version":"17.12.1-2","binary_name":"libasynccore1.5"},{"binary_name":"libasynccpp1.5","binary_version":"17.12.1-2"},{"binary_name":"libasyncqt1.5","binary_version":"17.12.1-2"},{"binary_name":"libecholib1.3","binary_version":"17.12.1-2"},{"binary_version":"17.12.1-2","binary_name":"qtel"},{"binary_name":"qtel-icons","binary_version":"17.12.1-2"},{"binary_version":"17.12.1-2","binary_name":"remotetrx"},{"binary_name":"svxlink-calibration-tools","binary_version":"17.12.1-2"},{"binary_version":"17.12.1-2","binary_name":"svxlink-gpio"},{"binary_name":"svxlink-server","binary_version":"17.12.1-2"},{"binary_name":"svxreflector","binary_version":"17.12.1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}},{"package":{"name":"svxlink","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.12.2-4","19.09.1-1","19.09.1-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libasyncaudio1.6","binary_version":"19.09.1-2"},{"binary_version":"19.09.1-2","binary_name":"libasynccore1.6"},{"binary_version":"19.09.1-2","binary_name":"libasynccpp1.6"},{"binary_name":"libasyncqt1.6","binary_version":"19.09.1-2"},{"binary_name":"libecholib1.3","binary_version":"19.09.1-2"},{"binary_version":"19.09.1-2","binary_name":"qtel"},{"binary_version":"19.09.1-2","binary_name":"qtel-icons"},{"binary_version":"19.09.1-2","binary_name":"remotetrx"},{"binary_version":"19.09.1-2","binary_name":"svxlink-calibration-tools"},{"binary_name":"svxlink-gpio","binary_version":"19.09.1-2"},{"binary_name":"svxlink-server","binary_version":"19.09.1-2"},{"binary_name":"svxreflector","binary_version":"19.09.1-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}},{"package":{"name":"svxlink","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.09.1-3"],"ecosystem_specific":{"binaries":[{"binary_version":"19.09.1-3","binary_name":"libasyncaudio1.6"},{"binary_version":"19.09.1-3","binary_name":"libasynccore1.6"},{"binary_name":"libasynccpp1.6","binary_version":"19.09.1-3"},{"binary_name":"libasyncqt1.6","binary_version":"19.09.1-3"},{"binary_name":"libecholib1.3","binary_version":"19.09.1-3"},{"binary_name":"qtel","binary_version":"19.09.1-3"},{"binary_version":"19.09.1-3","binary_name":"qtel-icons"},{"binary_version":"19.09.1-3","binary_name":"remotetrx"},{"binary_name":"svxlink-calibration-tools","binary_version":"19.09.1-3"},{"binary_name":"svxlink-gpio","binary_version":"19.09.1-3"},{"binary_name":"svxlink-server","binary_version":"19.09.1-3"},{"binary_version":"19.09.1-3","binary_name":"svxreflector"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}},{"package":{"name":"svxlink","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.09.2-1","19.09.2-1build1","19.09.2-1.1build2","19.09.2-1.1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libasyncaudio1.6t64","binary_version":"19.09.2-1.1build3"},{"binary_name":"libasynccore1.6t64","binary_version":"19.09.2-1.1build3"},{"binary_name":"libasynccpp1.6t64","binary_version":"19.09.2-1.1build3"},{"binary_version":"19.09.2-1.1build3","binary_name":"libasyncqt1.6t64"},{"binary_name":"libecholib1.3t64","binary_version":"19.09.2-1.1build3"},{"binary_name":"qtel","binary_version":"19.09.2-1.1build3"},{"binary_name":"qtel-icons","binary_version":"19.09.2-1.1build3"},{"binary_name":"remotetrx","binary_version":"19.09.2-1.1build3"},{"binary_version":"19.09.2-1.1build3","binary_name":"svxlink-calibration-tools"},{"binary_version":"19.09.2-1.1build3","binary_name":"svxlink-gpio"},{"binary_name":"svxlink-server","binary_version":"19.09.2-1.1build3"},{"binary_version":"19.09.2-1.1build3","binary_name":"svxreflector"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}},{"package":{"name":"svxlink","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/svxlink?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.02-5","25.05.1-2","25.05.1-4"],"ecosystem_specific":{"binaries":[{"binary_name":"libasyncaudio1.8","binary_version":"25.05.1-4"},{"binary_name":"libasynccore1.8","binary_version":"25.05.1-4"},{"binary_name":"libasynccpp1.8","binary_version":"25.05.1-4"},{"binary_version":"25.05.1-4","binary_name":"libasyncqt1.8"},{"binary_version":"25.05.1-4","binary_name":"libecholib1.3t64"},{"binary_name":"qtel","binary_version":"25.05.1-4"},{"binary_version":"25.05.1-4","binary_name":"qtel-icons"},{"binary_name":"remotetrx","binary_version":"25.05.1-4"},{"binary_name":"svxlink-calibration-tools","binary_version":"25.05.1-4"},{"binary_name":"svxlink-gpio","binary_version":"25.05.1-4"},{"binary_name":"svxlink-server","binary_version":"25.05.1-4"},{"binary_version":"25.05.1-4","binary_name":"svxreflector"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73149.json"}}],"schema_version":"1.9.0","severity":[{"type":"Ubuntu","score":"medium"}]}