CVE-2026-42996CWE-121

JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead…

Critical · published May 1, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
46.2
In the wild
Unconfirmed
What it is

JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This occurs in grid2deg in APRSISClient.cpp.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/V:D/RE:M/U:Green
EPSS
0.00566 · 46.2th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-05-01T06:42Z
EPSS history
Timeline
  • 01 MAY 06:42Z
    JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead…
    cvelistv5