Every CVE Search/ Get API key

CVE-2026-56770

libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID

8.7 High

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.58%Up 0.2 points since Jun 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
CVE-2026-56770
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-08
EUVDEUVD-2026-39523 8.7

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
EUVD-2026-39523
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-08
GitHub AdvisoriesGHSA-2f4m-q55c-v3xr 8.7

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when...

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
GHSA-2f4m-q55c-v3xr
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
NVD 8.7

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
CVE-2026-56770
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-129
Updated
2026-11-02
OSV 8.7

libais 0.15 - Out-of-bounds Vector Access in VdmStream::AddLine via Invalid Sequential Message ID

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
CVE-2026-56770
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-129
Updated
2026-11-09
OSVDEBIAN-CVE-2026-56770 7.5

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
DEBIAN-CVE-2026-56770
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56770 8.7

libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.

Record
UBUNTU-CVE-2026-56770
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-libais
Debian:12
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-30.17+git.20190917.master.e464cf8-40.17+git.20190917.master.e464cf8-50.17+git.20190917.master.e464cf8-6
 None known
python-libais
Debian:13
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-50.17+git.20190917.master.e464cf8-6
 None known
python-libais
Debian:14
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-50.17+git.20190917.master.e464cf8-6
 None known
python-libais
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-2build20.17+git.20190917.master.e464cf8-2build30.17+git.20190917.master.e464cf8-30.17+git.20190917.master.e464cf8-3build1
 None known
python-libais
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-3build30.17+git.20190917.master.e464cf8-40.17+git.20190917.master.e464cf8-4build1
 None known
python-libais
Ubuntu:25.10
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-5build10.17+git.20190917.master.e464cf8-6
 None known
python-libais
Ubuntu:26.10
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-6build2
 None known
python-libais
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.17+git.20190917.master.e464cf8-60.17+git.20190917.master.e464cf8-6build10.17+git.20190917.master.e464cf8-6build2
 None known

History

History
RecordedChangedSources
referencesOSV
referencesCVE List
factsEUVD
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-56770 is a high vulnerability (CVSS 8.7) in Schwehr Libais, published June 25, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open