Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in svxlink's LocationInfo/APRS functionality. In AprsTcpClient.cpp, updateQsoStatus() formats a remote EchoLink station's callsign and info into a fixed 80-byte stack buffer using sprintf. A long callsign or info string overflows the buffer, potentially enabling code execution. The overflow has existed since 2010. Fixed in version 26.05.1.