Dire Wolf CVE-2025-34457

Trigger requires delivering a crafted KISS frame to Dire Wolf's KISS frame handler (kiss_rec_byte() in src/kiss_frame.c) whose accumulated length reaches MAX_KISS_LEN, leaving no room for the appended terminating FEND byte. Affects versions up to and including 1.8 prior to commit 694c954. The key limiting factor is reachability of a KISS interface: Dire Wolf commonly exposes KISS over a local serial/pseudo-terminal device or a KISS-over-TCP socket, so remote exploitation is realistic only when that TCP KISS port is bound to a network-accessible interface rather than localhost or a trusted RF/serial link. No authentication or user interaction is required once the interface is reachable (PR:N/UI:N), and impact is limited to a crash/denial of service - no confidentiality or integrity loss.

Signals are consistent and point to a genuine but bounded availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, but impact is strictly availability (VC:N/VI:N/VA:H, SC/SI/SA:N) and CWE-121 plus the description confirm the end state is stack corruption leading to a crash/DoS - not code execution, despite the 'stack-based buffer overflow' label that often implies RCE. EPSS is low (0.51%, 42nd percentile), the CVE is NOT in CISA KEV, and no public exploit is identified in the provided data, so there is no evidence of active or imminent widespread exploitation. The 8.7 'High' score is driven largely by the network/unauthenticated reachability combined with high availability impact; it should be read as a crash/DoS bug, not a remote code execution threat. One caveat to verify: AV:N assumes the KISS interface is network-exposed, but Dire Wolf's KISS access is frequently a local serial/pseudo-terminal or a TCP port that may be bound to localhost or a trusted RF/LAN segment - real exposure depends on deployment, so the practical attack surface may be narrower than AV:N suggests.

An attacker with reach to a Dire Wolf KISS interface (e.g., its KISS-over-TCP port) sends a crafted KISS frame whose length hits MAX_KISS_LEN, so appending the terminating FEND byte overflows the fixed stack buffer. The subsequent kiss_unwrap() call reads/writes out of bounds, corrupting the stack and crashing the Dire Wolf process, dropping the TNC/APRS service. No public proof-of-concept is identified at time of analysis; exploitation is low-complexity (AC:L) and requires no authentication (PR:N) or user interaction.