Dire Wolf CVE-2025-34458
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach APRS/AX.25 input path
-
ExploitSend crafted MIC-E frame with empty comment
-
ExecutionAssertion fails in aprs_mic_e()
-
ImpactProcess terminates (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | No authentication or user interaction required (PR:N/UI:N): the attacker only needs a path by which Dire Wolf ingests an AX.25/APRS frame - RF reception, an APRS-IS internet feed, or a KISS/serial TNC link - and sends a MIC-E-format message whose comment field is empty or truncated (e.g., containing an embedded NUL byte near the end of the packet). The affected build is any Dire Wolf version up to and including 1.8 prior to commit 3658a87. The only limiting factor is that the attacker must be able to deliver a frame the target actually decodes, and impact is confined to crashing the decoding process (availability only); no code execution or data exposure results. |
| Impact | This is a genuine but narrow-impact issue: a reachable assertion (CWE-617) in Dire Wolf's APRS MIC-E decoder that a remote, unauthenticated attacker triggers by sending a malformed AX.25 frame, causing immediate process termination - a pure denial of service. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:N/VI:N/VA:H) is internally consistent with the description: no confidentiality or integrity impact, availability-only, no privileges or user interaction. The 8.7 'high' score is driven entirely by the availability metric and the easy, unauthenticated network reachability; it should NOT be read as an RCE-class threat. No EPSS score and no KEV listing are provided, and there is no indication of active exploitation, so exploitation status is limited to publicly documented reproducer code (issue 618 contains a contrived test case and VulnCheck published an advisory). The realistic priority is LOW-to-MEDIUM: trivially exploitable crash but confined to a niche amateur-radio TNC application, and a fix (commit 3658a87) already exists. NOTE a data conflict: one NVD reference (marlinkcyber MCSAID-2025-010) is titled 'direwolf-stack-buffer-overflow-kiss-frame,' which describes a DIFFERENT class of bug (stack buffer overflow via KISS frame) than this reachable-assertion MIC-E DoS - verify that reference belongs to this CVE. |
| Exploit ScenarioDerived | An attacker within reach of a Dire Wolf receiver - over RF/APRS, an APRS-IS network feed, or any AX.25 input path - transmits a crafted MIC-E packet with an empty or truncated comment field (including an embedded NUL near the packet end). When aprs_mic_e() decodes it, the assert(strlen(mcomment) > 0) fails and the process terminates. A public reproducer exists: the contrived test case in GitHub issue 618 and the VulnCheck advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Denial of service in Dire Wolf through 1.8 and before commit 3658a87 allows a remote, unauthenticated attacker to terminate the decoding process by delivering a malformed AX.25/APRS MIC-E frame whose comment field is empty or truncated, such as one containing an embedded NUL byte near the end of the packet. The flaw is a reachable assertion in aprs_mic_e() in src/decode_aprs.c (CWE-617) that aborts when the decoded comment string is not non-empty. No public exploit identified at time of analysis, and impact is availability-only: no code execution or data exposure results. The NVD CVSS 4.0 vector scores 8.7 with VA:H, while the independent assessment rates availability-only impact with no authentication or user interaction required.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Apply commit 3658a87 or upgrade to a Dire Wolf release that includes it; the change replaces the fatal assert(strlen(mcomment) > 0) with a safe empty-comment return path. If immediate patching is not possible, reduce exposure by restricting the input paths that reach the decoder, for example limiting APRS-IS feeds, RF receivers, or KISS/TNC connections to trusted sources, and run the decoder under a service manager configured to restart it automatically after a crash. Those compensating controls do not prevent the assertion-triggered termination and may trade availability for reduced attack surface. See https://github.com/wb2osz/direwolf/issues/618 and https://www.vulncheck.com/advisories/wb2osz-direwolf-reachable-assertion-dos for details.
Affected ProductsAI
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8 are affected if they predate commit 3658a87; the vulnerable component is the APRS MIC-E decoder in src/decode_aprs.c. No CPE string was provided in the input data. Relevant references are the upstream fix commit at https://github.com/wb2osz/direwolf/commit/3658a87, the upstream issue at https://github.com/wb2osz/direwolf/issues/618, and the VulnCheck advisory at https://www.vulncheck.com/advisories/wb2osz-direwolf-reachable-assertion-dos. A separate NVD reference to a marlinkcyber advisory describes a KISS-frame stack buffer overflow and should not be conflated with this CVE's MIC-E assertion denial of service.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dire Wolf decodes APRS traffic carried in AX.25 frames, including MIC-E-encoded position/status messages that pack data into the AX.25 destination address and a short information field. The vulnerable function, aprs_mic_e() in src/decode_aprs.c, parsed that information field and relied on an assertion, assert(strlen(mcomment) > 0), to guarantee a non-empty comment. A crafted frame can place a NUL byte near the end of the packet, so strlen() sees an empty comment even though bytes remain; because the assertion is a fatal check rather than a recoverable error path, the decoder process terminates immediately. This is CWE-617, a reachable assertion. The upstream fix in commit 3658a87 removes the assert and instead checks whether the comment length is less than 1, returning an 'UNKNOWN vendor/model' result rather than aborting. No CPE string was supplied, but source evidence ties the issue to wb2osz/direwolf through 1.8 prior to that commit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) and independent CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate remote, unauthenticated, availability-only impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated malformed frame with no user interaction reliably crashes the process; availability-only impact, no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.
Executive ViewAI
Dire Wolf, an open-source APRS/AX.25 packet decoder used in amateur radio iGates, digipeaters, and emergency communications, can be halted entirely by a single malformed MIC-E frame in versions through 1.8. The failure is availability-only - no code execution or data exposure - but each malicious frame terminates the decoding process, and sustained traffic can keep APRS message relay and situational awareness offline indefinitely. Leadership should prioritize this only where Dire Wolf supports operational or emergency communications; for organizations without such deployments, exposure is limited to isolated hobbyist or lab systems. No vendor-released patch is currently available, so continuity depends on interim mitigations and process supervision.
No vendor-released patch identified at time of analysis; upstream fix commit 3658a87 addresses the assertion. Interim mitigations: build or upgrade to source at or after commit 3658a87; restrict APRS-IS/KISS interfaces to trusted source addresses and networks; apply ingress allow-list or signature filtering to drop truncated or NUL-containing MIC-E frames; enable automatic process restart with alerting on abnormal termination; run the decoder as a low-privilege, isolated service; monitor upstream advisories for a formal release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB