Which versions of libais are affected by CVE-2026-56770?

libais library versions through 0.15 contains a denial-of-service vulnerability with publicly available exploit code affecting AIS (Automatic Identification System) processing services and vessel…

Is there a public PoC exploit available for CVE-2026-56770?

Yes, a public proof-of-concept exploit is available for CVE-2026-56770. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-56770?

Within 24 hours: Inventory all systems running libais versions ≤0.15 and assess network exposure to untrusted input sources. Within 7 days: Deploy input validation to reject malformed AIVDM sentences with empty or out-of-range sequential message IDs; implement network segmentation isolating AIS processors from untrusted networks. Within 30 days: Monitor vendor repositories and libais GitHub for patch availability; prepare and test upgrade procedures for patched versions when released.

libais CVE-2026-56770

Q: What is the CVSS score of CVE-2026-56770?

CVE-2026-56770 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39523 HIGH

Improper Validation of Array Index (CWE-129)

2026-06-25 VulnCheck

GHSA-2f4m-q55c-v3xr

Denial Of Service Libais

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated AIS sentence injection with low complexity (AV:N/AC:L/PR:N/UI:N); impact is a crash/DoS so A:H with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 18:52 vuln.today

DescriptionCVE.org

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

AnalysisAI

Denial of service in libais through version 0.15 lets remote unauthenticated attackers crash AIS-processing services and vessel systems by sending malformed AIVDM sentences. The VdmStream::AddLine routine treats an unchecked sentinel value as a vector index when a sentence carries an empty or out-of-range sequential message ID, producing an out-of-bounds vector access (CWE-129) and potential memory corruption. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.

Technical ContextAI

libais (cpe:2.3:a:schwehr:libais) is an open-source C++ library by Kurt Schwehr for decoding AIS (Automatic Identification System) messages - the maritime VHF data protocol used by ships, shore stations, and AIS aggregators to broadcast position and identity. AIVDM/AIVDO NMEA sentences carry a sequential message ID field used to reassemble multi-part messages. The flaw is rooted in CWE-129 (Improper Validation of Array Index): VdmStream::AddLine uses a sentinel value that signals 'no/empty sequential message ID' directly as an index into an internal vector without bounds checking, so an empty or out-of-range ID causes the code to read or write outside the vector's bounds, leading to a crash or memory corruption.

RemediationAI

No vendor-released patch version is identified in the available data; the references point to the upstream GitHub issue (https://github.com/schwehr/libais/issues/263) rather than a tagged release, so monitor that issue and the libais repository for a fixed version and upgrade once published. As compensating controls until a patched build is available, validate or sanitize incoming AIVDM/AIVDO sentences upstream of libais - drop sentences whose sequential message ID field is empty or outside the expected range before they reach VdmStream::AddLine (trade-off: requires a filtering proxy and may discard some malformed-but-benign traffic). Restrict and authenticate the IP feeds that deliver AIS data and isolate the parsing service so a crash cannot take down dependent navigation or monitoring systems (trade-off: VHF radio-sourced sentences cannot be authenticated and remain a path, so radio-fed deployments should run the parser in a sandboxed, auto-restarting process). Review the VulnCheck advisory (https://www.vulncheck.com/advisories/libais-out-of-bounds-vector-access-in-vdmstream-addline-via-invalid-sequential-message-id) for fix confirmation.