APRS Library CVE-2026-73150

Exploitation conditions cannot be fully specified due to missing CVSS vector data. Based on the description, exploitation likely requires that the target system is actively constructing or parsing APRS messages - meaning APRS software must be installed and running. Whether exploitation is possible over a network (e.g., via an APRS-IS internet gateway feed) or requires local/radio-proximity access is not confirmed. No authentication requirements can be stated without a CVSS PR metric. The limiting factor is the narrow deployment context: APRS software is primarily used by amateur radio operators and is not commonly exposed as a general internet service.

Risk assessment is severely constrained by missing data: no CVSS score, no CVSS vector, no CWE, no EPSS score, no KEV status, no POC availability, and no patch version are present in the intelligence provided. The only confirmed signal is a Ubuntu vendor report referencing GHSA-4f8x-49pf-3x5v. Buffer overflows in message construction can range from crash-only (denial of service) to code execution depending on memory layout and exploit mitigations in place. APRS software is predominantly used in amateur radio contexts, limiting the attack surface compared to general-purpose network software. Without CVSS attack vector data, it is unknown whether exploitation requires local access, network access, or physical proximity to a radio receiver. Severity cannot be responsibly assessed from the available data alone.

An attacker able to supply a crafted APRS message to a vulnerable parsing or construction routine could trigger a buffer overflow, potentially causing a crash or, under favorable memory conditions, arbitrary code execution. No public proof-of-concept code has been identified at time of analysis. The realistic attack surface is limited to systems that ingest APRS data from radio networks or network feeds.