EchoLink CVE-2026-73153

Exploitation requires network reachability to an active EchoLink node's RTCP port, which is open during active VoIP sessions. EchoLink restricts inbound connections to registered and validated amateur radio callsigns through its authentication system, meaning an attacker must either possess a valid callsign credential, bypass the callsign validation step, or interact at the RTCP protocol layer before authentication is enforced - the precise timing of authentication relative to RTCP packet acceptance is not confirmed from available data. No special operating system configuration is required beyond running the EchoLink application. Authentication requirements at the RTCP layer are not independently confirmed because no CVSS vector was provided.

Risk signals for this CVE are sparse: no CVSS score or vector was provided, EPSS data is absent, the vulnerability is not listed in CISA KEV, and no POC has been identified. The vulnerability class - out-of-bounds read in a network protocol parser - is inherently network-reachable if the EchoLink node accepts RTCP from untrusted peers, which is plausible given EchoLink's peer-to-peer amateur radio networking model. However, EchoLink restricts access to licensed amateur radio operators via a callsign validation system, which materially limits the attacker pool compared to fully public-facing services. Practical impact is likely bounded to application crash (denial of service) or limited memory disclosure, typical of out-of-bounds reads without a write primitive. Overall real-world risk is moderate-to-low given the niche deployment footprint and restricted network access model, though operators exposing EchoLink nodes to the broader internet should patch promptly. CVSS metrics, EPSS score, and precise affected version range are all missing from available data - this assessment is inferential.

A remote attacker within network reach of an EchoLink node crafts a malformed RTCP SDES packet with an invalid or oversized item length field and transmits it to the node's RTCP port. The parser reads beyond the allocated packet buffer, potentially causing the EchoLink process to crash (denial of service) or exposing adjacent memory contents. No public exploit code has been identified at time of analysis, so exploitation would require independently developing a malformed packet.