Skip to main content

svxreflector CVE-2026-73148

MEDIUM
2026-08-13 vendor:ubuntu
Information Disclosure Red Hat
Share

Severity by source

vuln.today AI
7.0 HIGH

Network-reachable reflector daemon, but heap exploit reliability warrants AC:H; no authentication confirmed required; availability impact is high as crash is the most reliable outcome.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Red Hat
HIGH
qualitative

Lifecycle Timeline

1
Analysis Generated
Aug 14, 2026 - 20:10 vuln.today

DescriptionCVE.org

[GHSA-6wgq-wg3w-jgvx: svxreflector: use-after-free write via dangling JSON reference]

AnalysisAI

Use-after-free write in svxreflector, the reflector server component of the SvxLink amateur radio internet linking system, occurs when a dangling JSON reference is dereferenced after the underlying object has been freed. The vulnerability was disclosed via GitHub Security Advisory GHSA-6wgq-wg3w-jgvx and is tracked in Ubuntu's package ecosystem. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to public svxreflector port
Delivery
Send crafted JSON-structured protocol message
Exploit
Trigger dangling reference dereference
Execution
Write to freed heap memory
Impact
Crash daemon or achieve code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The svxreflector daemon must be reachable over the network and must process JSON-structured input from connecting nodes - this is standard operation for any running reflector instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Formal CVSS scoring data was not provided, making quantitative risk assessment impossible without independent research. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker operating a malicious or compromised SvxLink node sends crafted JSON-structured protocol messages to a public svxreflector instance. The server processes the message, triggers the dangling-reference condition during JSON handling, and dereferences freed memory, causing a write-after-free. …
Remediation No exact patch version was provided in the input data. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Share

CVE-2026-73148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy