CVE-2026-42996: JS8Call and JS8Call-improved Stack-based Buffer Overflow in APRS Grid Handling

Overview

This record describes a stack-based buffer overflow (CWE-121) in the grid2deg function of APRSISClient.cpp, affecting JS8Call up to and including 2.3.1 and JS8Call-improved versions before 3.0. According to the description, the condition is reached when the software processes a radio transmission containing an @APRSIS GRID message followed by a long Maidenhead locator.

Impact

• The record classifies the CVSS 4.0 base score as 10 with high confidentiality, integrity and availability impact on the vulnerable system.
• SSVC lists the technical impact as total and the automatable property as yes.
• Stack buffer overflows can corrupt program memory. Whether this specific flaw allows code execution is not stated in the record and is an inference that would require vendor or researcher confirmation.

Affected products and versions

• JS8Call: versions through 2.3.1.
• JS8Call-improved: versions before 3.0.

The record does not list any fixed versions. The absence of a listed fix does not mean no fix exists, and the status of the referenced commit relative to this issue is not stated in the record.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. SSVC records the exploitation state as poc, which indicates that proof-of-concept activity is recorded in the data, but this is not the same as confirmed active exploitation. The EPSS probability is 0.00566 with a percentile of 0.45489.

Remediation and mitigation

• Identify all JS8Call and JS8Call-improved installations and their exact versions.
• Review the JS8Call-improved security advisory and the referenced commit to determine whether an updated build addresses this issue, and confirm with the maintainers.
• Where an update cannot be applied immediately, restrict the use of these applications on untrusted or shared systems and limit exposure of the host to untrusted radio-originated input, as far as the operating environment allows.
• Consider the software's exposure through its APRS-IS connectivity and plan for prompt upgrading once a verified fixed version is published.

Detection guidance

• Monitor for unexpected crashes or restarts of JS8Call or JS8Call-improved processes, which can be a sign of memory corruption.
• Review logs and reporting for unusual APRS-IS grid-related messages, while recognizing that the record does not describe specific indicators of compromise.
• Keep endpoint and host logging enabled on systems running these applications.

Limitations of the available information

• The record provides no fixed version and no vendor statement on remediation.
• It does not describe the exact memory layout, the exploitability conditions beyond the stated trigger, or whether code execution is possible.
• The NVD record and the JS8Call source reference are the basis for the technical description, and no additional vendor advisory for JS8Call itself was provided in the record.

Frequently asked questions

Which versions are affected by CVE-2026-42996?

The record lists JS8Call through 2.3.1 and JS8Call-improved before 3.0 as affected. No fixed version is listed in the record.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. SSVC records the exploitation state as poc.

What should administrators do now?

Inventory affected installations, check the JS8Call-improved advisory and referenced commit with maintainers for an updated build, and restrict use on untrusted systems until a verified fix is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.