A stack-based buffer overflow exists in JS8Call and JS8Call-improved as a result of handling radio transmissions that begin with the @APRSIS GRID prefix followed by an excessively long Maidenhead locator. When the grid2deg function copies this data without proper bounds checking, the stack is corrupted, enabling an attacker to execute arbitrary code, crash the application, or cause a denial‑of‑service. This vulnerability is categorized as CWE‑121.

All releases of JS8Call up to and including version 2.3.1 and all releases of JS8Call‑improved preceding version 3.0 are impacted. The affected vendors are JS8Call and JS8Call‑improved as distributed through their respective release channels.

The CVSS score of 10 indicates a critical severity. Though a recent EPSS figure is not available, the lack of a KEV listing suggests no known exploit yet, but the well‑known nature of stack overflows makes exploitation likely through the radio interface. The attack can be performed remotely by an adversary transmitting a crafted APRSIS GRID packet, which could lead to remote code execution or denial of service on the target station.