Libais
Monthly
Denial of service in libais through version 0.15 lets remote unauthenticated attackers crash AIS-processing services and vessel systems by sending malformed AIVDM sentences. The VdmStream::AddLine routine treats an unchecked sentinel value as a vector index when a sentence carries an empty or out-of-range sequential message ID, producing an out-of-bounds vector access (CWE-129) and potential memory corruption. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.
Denial of service in libais through version 0.15 lets remote unauthenticated attackers crash AIS-processing services and vessel systems by sending malformed AIVDM sentences. The VdmStream::AddLine routine treats an unchecked sentinel value as a vector index when a sentence carries an empty or out-of-range sequential message ID, producing an out-of-bounds vector access (CWE-129) and potential memory corruption. Publicly available exploit code exists and the issue was reported by VulnCheck, though it is not listed in CISA KEV.