CVE-2026-42996: JS8Call Buffer Overflow Vulnerability

CVE-2026-42996 Overview

CVE-2026-42996 is a stack-based buffer overflow in JS8Call, an amateur radio digital mode application. The flaw exists in the grid2deg function within APRSISClient.cpp and is triggered by a radio transmission of @APRSIS GRID followed by an overlong Maidenhead locator. JS8Call through version 2.3.1 and JS8Call-improved before version 3.0 are affected. The vulnerability is classified under CWE-121: Stack-based Buffer Overflow and can be reached remotely over radio without authentication or user interaction.

Critical Impact
A specially crafted APRS message transmitted over radio can corrupt the stack of any receiving JS8Call instance, enabling potential arbitrary code execution on the operator's workstation.

Affected Products

JS8Call through 2.3.1
JS8Call-improved before 3.0
APRSISClient.cpp component (grid2deg function)

Discovery Timeline

2026-05-01 - CVE-2026-42996 published to the National Vulnerability Database
2026-05-01 - Last updated in NVD database
2026-05-07 - EPSS scoring data published

Technical Details for CVE-2026-42996

Vulnerability Analysis

JS8Call processes Automatic Packet Reporting System (APRS) messages received over the air. When a station transmits an @APRSIS GRID directive followed by a Maidenhead grid locator, the receiving client parses the locator string inside the grid2deg function in APRSISClient.cpp. The function writes parsed character pairs into fixed-size stack arrays without validating the input length, so an attacker who transmits a locator longer than the standard 6 to 8 character format overruns the buffer and corrupts adjacent stack data including the saved return address.

The vulnerability is reachable over radio frequency, meaning any JS8Call user receiving APRS traffic on a monitored frequency can be targeted without prior authentication or interaction. Successful exploitation may yield arbitrary code execution in the context of the user running JS8Call.

Root Cause

The grid2deg function uses fixed-size local arrays (valx and valy) sized for a standard Maidenhead locator. The parsing loop iterates over every regex match of latitude and longitude character pairs in the supplied input but never checks the loop index against the array bounds. A locator string containing more pairs than the buffer can hold causes writes past the end of the stack arrays.

Attack Vector

An attacker transmits an APRS frame on a frequency monitored by the victim's JS8Call instance. The frame body contains the directive @APRSIS GRID followed by a Maidenhead locator long enough to overflow the destination buffer. Because amateur radio transmissions are broadcast, a single transmission can target every station on the band running a vulnerable client.

cpp

// Patch from JS8Call-improved/APRSISClient.cpp
     foreach (QStringList matched, lats) {
         char x = matched.at(1).at(0).toLatin1();
         char y = matched.at(2).at(0).toLatin1();
-
+        if (i * 2 + 1 >= 22) break;
         valx[i * 2] = x - A;
         valy[i * 2] = y - A;
-
         i++;
         tot++;
     }

Source: JS8Call-improved commit a6c7a19. The patch adds a bounds check that breaks out of the loop before the index can write past the 22-byte capacity of the valx and valy arrays.

Detection Methods for CVE-2026-42996

Indicators of Compromise

Inbound APRS messages containing the string @APRSIS GRID followed by a locator longer than 8 characters
JS8Call process crashes, segmentation faults, or unexpected child processes spawning from the JS8Call binary
Unexpected outbound network connections originating from the JS8Call process after receiving APRS traffic
Operating system crash dumps referencing APRSISClient.cpp or the grid2deg symbol

Detection Strategies

Inspect JS8Call logs and APRS message decoders for grid locator fields exceeding the standard Maidenhead length
Monitor endpoints running JS8Call for process crashes and abnormal memory access violations
Apply endpoint detection rules that flag shell, scripting, or network utility processes spawning from the JS8Call executable
Correlate radio operator workstation alerts with timestamps of received APRS frames to identify exploitation attempts

Monitoring Recommendations

Enable verbose APRS logging in JS8Call to capture the raw locator strings of received messages
Track the JS8Call binary version inventory across operator workstations to identify unpatched hosts
Alert on any modification of files in the JS8Call installation directory or user profile after receiving APRS traffic

How to Mitigate CVE-2026-42996

Immediate Actions Required

Upgrade JS8Call-improved to version 3.0 or later, which includes the bounds check in grid2deg
For users on upstream JS8Call 2.3.1 with no fixed release available, disable APRS reception until a patch is applied
Restrict JS8Call workstations to non-privileged user accounts to limit the impact of code execution
Audit operator endpoints for unexpected processes or persistence after recent APRS activity

Patch Information

The fix is committed in the JS8Call-improved repository as commit a6c7a19b and is documented in GitHub Security Advisory GHSA-98hp-pjp7-w62x. The patch adds the guard if (i * 2 + 1 >= 22) break; inside the grid2deg parsing loop to prevent writes beyond the 22-byte stack buffers. Users of upstream JS8Call should track the JS8Call source repository for an equivalent backport.

Workarounds

Disable APRS-IS gateway functionality in JS8Call configuration until upgrading
Run JS8Call inside a sandbox or isolated virtual machine to contain successful exploitation
Filter inbound APRS messages at the modem or software layer to drop frames whose grid locator field exceeds 8 characters
Review the JS8 APRS Documentation for legitimate locator formatting expectations

bash

# Verify installed JS8Call version on Linux
js8call --version

# Build JS8Call-improved from the patched source
git clone https://github.com/JS8Call-improved/JS8Call-improved.git
cd JS8Call-improved
git checkout a6c7a19b82bbd7c2c0c892576f84d7449e8c7088
mkdir build && cd build
cmake ..
make -j$(nproc)
sudo make install