CVE-2025-66217
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
AIS-catcher, a multi-platform AIS receiver, prior to version 0.64 has an integer underflow vulnerability in MQTT parsing logic. An attacker can trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field, leading to immediate DoS and, when used as a library, severe Memory Corruption that can be leveraged for RCE.
Risk Assessment
An attacker can cause denial of service or, when used as a library, remote code execution, potentially leading to full system compromise.
Recommendation
Update AIS-catcher to version 0.64 or later, which contains the fix.
Other vulnerabilities in AIS-catcher
Original NVD description (English source)
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS