PT-2026-36303 · Unknown+1 · Js8Call-Improved+1

Published 2026-05-01 · Updated 2026-05-01 · CVE-2026-42996

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions JS8Call versions prior to 2.3.2 JS8Call-improved versions prior to 3.0

Description A stack-based buffer overflow occurs during the processing of a radio transmission containing @APRSIS GRID followed by a long Maidenhead locator. This issue is located in the grid2deg() function within the APRSISClient.cpp file.

Recommendations Update JS8Call to version 2.3.2 or later. Update JS8Call-improved to version 3.0 or later.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-42996

Affected Products

Js8Call

Js8Call-Improved

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42996 · Security Note
• https://github.com/js8call/js8call/blob/fd721e8b67eed84cb3c09d018205ab9a53e1a8b1/APRSISClient.cpp#L89-L102 · Note
• https://github.com/JS8Call-improved/JS8Call-improved/security/advisories/GHSA-98hp-pjp7-w62x · Note
• https://amateur-radio-resources.sourceforge.io/PDF/JS8APRS.pdf · Note