CVE-2025-66217: AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-29 · updated 2026-10-07
Weakness: CWE-122

Description

AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.

Affected products

jvde-github AIS-catcher: before 0.64 — fixed in 0.64

How to fix

Upgrade to a fixed version: jvde-github AIS-catcher 0.64. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-66217 or the next vulnerability affects your stack