CVE-2025-66216: Aiscatcher Ais-catcher Buffer Overflow

CVE-2025-66216 Overview

CVE-2025-66216 is a critical heap buffer overflow vulnerability identified in the AIS::Message class of AIS-catcher, a multi-platform Automatic Identification System (AIS) receiver application used for maritime vessel tracking and monitoring. Prior to version 0.64, the vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer, leading to potential remote code execution.

Critical Impact

Attackers can exploit this heap buffer overflow to write arbitrary data beyond allocated memory boundaries, potentially achieving remote code execution on systems running vulnerable versions of AIS-catcher.

Affected Products

• AIS-catcher versions prior to 0.64
• All platforms supported by AIS-catcher (Linux, Windows, Raspberry Pi, Android)
• Systems processing AIS messages via the vulnerable AIS::Message class

Discovery Timeline

• 2025-11-29 - CVE-2025-66216 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2025-66216

Vulnerability Analysis

This vulnerability is classified under CWE-131 (Incorrect Calculation of Buffer Size) and CWE-787 (Out-of-bounds Write). The flaw exists in the setUint function within Source/Marine/Message.cpp, where an incorrect buffer size calculation allows attackers to overflow a fixed 128-byte buffer with approximately 1KB of data.

The vulnerability is network-accessible, requiring no authentication or user interaction, making it particularly dangerous for internet-exposed AIS receiver deployments. Successful exploitation could lead to complete system compromise with high impact on confidentiality, integrity, and availability.

Root Cause

The root cause lies in an incorrect boundary check within the setUint function of the Message class. The original code performed a bit-shift operation (length >> 3) before comparing against MAX_AIS_LENGTH, effectively dividing the length by 8. This miscalculation allowed the buffer to be written well beyond its allocated size, as the check would only trigger when the length was approximately 8 times greater than intended.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can craft malicious AIS messages that, when processed by the vulnerable Message class, trigger the heap buffer overflow. This could be accomplished by:

1. Broadcasting specially crafted AIS radio signals
2. Injecting malicious data through network-based AIS data feeds
3. Providing malformed AIS message data through any input interface accepted by AIS-catcher

// Security patch from Source/Marine/Message.cpp
// Before (vulnerable):
bool Message::setUint(int start, int len, unsigned val)
{
    if (length >> 3 >= MAX_AIS_LENGTH)  // VULNERABLE: Incorrect bit-shift check
        return false;

// After (fixed):
bool Message::setUint(int start, int len, unsigned val)
{
    if (length >= MAX_AIS_LENGTH)  // FIXED: Direct comparison without bit-shift
        return false;

Source: GitHub Commit 3de0ef7

Detection Methods for CVE-2025-66216

Indicators of Compromise

• Unexpected crashes or segmentation faults in AIS-catcher processes
• Anomalous memory usage patterns in systems running AIS-catcher
• Unusual AIS message sizes exceeding normal protocol specifications
• Evidence of heap corruption or memory manipulation in process dumps

Detection Strategies

• Monitor AIS-catcher process behavior for signs of memory corruption or unexpected termination
• Implement network monitoring for malformed AIS messages with abnormally large payloads
• Deploy application-level logging to track AIS message processing errors
• Use memory protection tools (AddressSanitizer, Valgrind) during development and testing

Monitoring Recommendations

• Enable verbose logging on AIS-catcher installations to capture processing anomalies
• Monitor system logs for heap corruption indicators or out-of-memory conditions
• Track network traffic patterns for unusual AIS data feed characteristics
• Implement alerting for AIS-catcher process restarts or crash events

How to Mitigate CVE-2025-66216

Immediate Actions Required

• Upgrade AIS-catcher to version 0.64 or later immediately
• Isolate vulnerable AIS-catcher instances from untrusted network segments
• Review access controls for systems receiving AIS data feeds
• Audit logs for any signs of exploitation attempts on vulnerable systems

Patch Information

The vulnerability has been patched in AIS-catcher version 0.64. The fix corrects the boundary check in the setUint function by removing the erroneous bit-shift operation (>> 3), ensuring the length comparison operates correctly against MAX_AIS_LENGTH. Users should update to version 0.64 or later by pulling the latest release from the official GitHub repository. For detailed patch information, refer to the security advisory GHSA-v53x-f5hh-g2g6.

Workarounds

• If immediate patching is not possible, consider temporarily disabling AIS-catcher until the update can be applied
• Implement network segmentation to restrict access to AIS-catcher instances from untrusted sources
• Deploy network-level filtering to validate AIS message integrity before processing
• Run AIS-catcher with reduced privileges to limit the impact of potential exploitation

# Update AIS-catcher to patched version
git clone https://github.com/jvde-github/AIS-catcher.git
cd AIS-catcher
git checkout v0.64  # or later version
mkdir build && cd build
cmake ..
make
sudo make install