JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator.
CVSS 4.0CRITICAL 10.0·Network·No auth·No interaction·EPSS 0.00571·Published 2026-05-01·Fixed in 3.0CWE-121