Stack-Based Buffer Overflow in JS8Call by JS8Call-improved

CVE-2026-42996

What is CVE-2026-42996?

A stack-based buffer overflow exists in JS8Call versions up to 2.3.1 and JS8Call-improved prior to 3.0. This vulnerability occurs when processing a radio transmission of the @APRSIS GRID, which is followed by an excessively long Maidenhead locator string. The flaw is located in the grid2deg function within the APRSISClient.cpp file, allowing attackers to exploit the vulnerability by crafting malicious radio messages, potentially leading to unexpected behavior and system crashes.

References