CVE-2025-66216 is a critical (CVSS 9.8) heap buffer overflow in the AIS::Message class of AIS-catcher, a multi-platform AIS receiver. About 1KB can be written into a 128 byte buffer. The record says it is patched in 0.64. The GitHub advisory lists no patched version, so confirm against the release.
What's affected
- Product: AIS-catcher, an AIS (marine vessel tracking) receiver written in C++.
- Affected per the record: versions before 0.64.
- Fixed per the record: 0.64.
- Fixed per the advisory: the advisory lists affected versions as above 0.63 and patched versions as None, and describes a fix in a commit.
Sources disagree on versions. The record says patched in 0.64. The advisory page does not name a patched release. Use the fix commit and the project release notes to confirm that your build contains the fix, rather than trusting either field alone. Both sources give critical severity.
How to check if you're exposed
Check which version or commit you run.
AIS-catcher -h | head
git -C /path/to/AIS-catcher describe --tags
If you built from source, compare your commit with the fix commit linked in the sources below. If you use a packaged build or a container image, check the release or tag it was built from and whether it is 0.64 or later. Also find out whether the receiver is reachable from outside your network, or fed by data sources you do not control.
What to do now
- Upgrade to 0.64 or later, and verify that the build includes the fix commit because the advisory does not list a patched version.
- Rebuild any container images or packages that bundle an older AIS-catcher.
- Limit exposure of the receiver and any web or network ports it opens. Run it as an unprivileged user.
- If the instance feeds a wider system, watch it for crashes or restarts, which can signal memory corruption.
- Add native and vendored C++ components to your software inventory. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory identifies a byte versus bit confusion in a bounds check. The buffer is defined in bytes, but the check compares a length in bytes against a limit expressed in bits, so the check lets writes run far past the end of the buffer. The record tags it CWE-131, CWE-787, which covers an incorrect calculation of buffer size and an out-of-bounds write.
The advisory says the authors demonstrated code execution in their own testing. We do not repeat the technical details here. For defenders, the point is that memory unsafe parsers of network data deserve the same patch discipline as web apps. The record does not mark this as exploited in the wild and it is not on CISA KEV.
Quick check
Which version fixes CVE-2025-66216?
The record says 0.64. The advisory lists no patched version, so confirm with the release notes or the fix commit.
Is this exploited in the wild?
Not according to the record. It is not on the CISA KEV list.
Sources
Last reviewed: 18 October 2026.
