Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in svxlink. The audio decoders use a variable-length array (VLA) on the stack that is sized by an attacker-controlled encoded-frame length field received over the network. A remote attacker can send a specially crafted frame with an excessively large length value, causing stack exhaustion and a denial of service. Fixed in version 26.05.1.