Executive brief
libais is a software library used to decode Automatic Identification System (AIS) messages, which are essential for tracking and identifying maritime vessels. A vulnerability in this library allows a remote attacker to crash maritime tracking services or vessel systems by sending specially crafted radio or network signals. This could lead to a loss of situational awareness for ship operators and port authorities, potentially disrupting maritime operations.
Technical details
A vulnerability classified as CWE-129 (Improper Validation of Array Index) exists in libais through version 0.15 within the VdmStream::AddLine function. The issue stems from the use of an unchecked sentinel value as a vector index when the library processes AIS sentences containing empty or out-of-range sequential message IDs. An unauthenticated remote attacker can exploit this by transmitting crafted AIVDM sentences via VHF marine radio or IP-based data feeds. Successful exploitation leads to out-of-bounds memory access, which can cause service crashes (Denial of Service) or potential memory corruption. As of the advisory date, the vulnerability is reported in versions up to 0.15.
Affected products
- schwehr libais <= 0.15
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory