Integer Underflow in AIS-catcher MQTT Parsing Logic

CVE-2025-66217

What is CVE-2025-66217?

AIS-catcher, a multi-platform AIS receiver, prior to version 0.64, contains an integer underflow vulnerability in its MQTT parsing logic. This flaw can be exploited by an attacker through a crafted MQTT packet that manipulates the Topic Length field, triggering a significant Heap Buffer Overflow. The outcome of this exploit can lead to Denial of Service (DoS) and, when utilized in library contexts, causes critical Memory Corruption that may enable Remote Code Execution (RCE). Users are encouraged to upgrade to version 0.64 or later to mitigate this vulnerability.

References