Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-66216 is a critical-severity Incorrect Calculation of Buffer Size (CWE-131) vulnerability in Aiscatcher Ais-Catcher. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-66216 is a heap buffer overflow vulnerability in the AIS::Message class of AIS-catcher, an open-source multi-platform AIS receiver software. Affecting versions prior to 0.64, the flaw enables an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer, stemming from improper handling of input sizes as indicated by associated CWEs-131 (Incorrect Calculation of Buffer Size) and CWE-787 (Out-of-bounds Write). The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity due to network accessibility, low attack complexity, and no requirements for privileges or user interaction.
The vulnerability can be exploited remotely by unauthenticated attackers over the network with minimal prerequisites. Successful exploitation allows arbitrary code execution, data corruption, or denial of service by overwriting heap memory beyond the intended buffer boundaries, potentially compromising the AIS-catcher's functionality in receiving and processing Automatic Identification System (AIS) maritime data transmissions.
Mitigation is available through upgrading to AIS-catcher version 0.64, where the issue has been addressed via a specific commit. Official guidance is provided in the project's GitHub security advisory (GHSA-v53x-f5hh-g2g6) and the corresponding patch commit, recommending users review and apply the update promptly to prevent exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199899
Vulnerability Data
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer.…
more
This issue has been patched in version 0.64.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer security testing and code review can discover incorrect buffer-size computations before deployment.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Secure engineering principles directly require correct buffer-size arithmetic and bounds-checked allocation.
Input validation can enforce that supplied lengths or counts used in size calculations are within safe bounds.
Memory-protection mechanisms limit the exploitability of an overflow that results from an incorrect size calculation.
Flaw-remediation processes that include vulnerability scanning or static analysis will surface buffer-size errors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent buffer-size miscalculations via coding standards, reviews, and testing, while fixing this single weakness only partially fulfills the broader control.
Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.
Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly require correct buffer-size calculations.
Security testing can detect buffer-size errors before release.
Secure development lifecycle mandates size-checking practices that reduce buffer-size miscalculations.
Application security requirements can specify buffer-size validation rules.
Secure architecture principles include safe memory-allocation guidelines.
Change management can enforce review gates that catch unsafe memory operations before deployment.