CVE-2026-56770

Name	CVE-2026-56770
Description	libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash services or vessel systems by sending crafted AIVDM sentences over VHF marine radio or IP feeds, causing out-of-bounds memory access and potential corruption.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-libais (PTS)	bullseye	0.17+git.20190917.master.e464cf8-2	vulnerable
	bookworm	0.17+git.20190917.master.e464cf8-3	vulnerable
	trixie	0.17+git.20190917.master.e464cf8-5	vulnerable
	forky, sid	0.17+git.20190917.master.e464cf8-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-libais	source	(unstable)	(unfixed)

https://github.com/schwehr/libais/issues/263