Nixpkgs security tracker

Dismissed

Permalink CVE-2026-42996

updated 3 days, 18 hours ago by @LeSuisse Activity log

Created suggestion 4 days, 3 hours ago
@LeSuisse dismissed 3 days, 18 hours ago

JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based …

JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This occurs in grid2deg in APRSISClient.cpp.

References

https://github.com/JS8Call-improved/JS8Call-improved/security/advisories/GHSA-9… exploit
https://amateur-radio-resources.sourceforge.io/PDF/JS8APRS.pdf
https://github.com/js8call/js8call/blob/fd721e8b67eed84cb3c09d018205ab9a53e1a8b…
https://github.com/JS8Call-improved/JS8Call-improved/commit/a6c7a19b82bbd7c2c0c…

Affected products

JS8Call

=<2.3.1

JS8Call-improved

<3.0

Matching in nixpkgs

pkgs.js8call

Weak-signal keyboard messaging for amateur radio

nixos-unstable 2.5.2
- nixpkgs-unstable 2.5.2
- nixos-unstable-small 2.5.2
nixos-25.11 2.5.2
- nixos-25.11-small 2.5.2
- nixpkgs-25.11-darwin 2.5.2

Package maintainers

@pdg137 Paul Grayson
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>

Current stable branch was never impacted

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.js8call

Package maintainers