Log in Start free

Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck

CVE-2025-34458wb2osz/direwolf <= 1.8.1 Reachable Assertion DoS

High 8.7

In plain English

A high-severity security flaw in Dire Wolf from wb2osz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14direwolf1.8.1+dfsg-2DEBIAN-CVE-2025-34458
Ubuntu:22.04:LTSdirewolfno fix listedUBUNTU-CVE-2025-34458
Ubuntu:24.04:LTSdirewolfno fix listedUBUNTU-CVE-2025-34458
Ubuntu:25.10direwolfno fix listedUBUNTU-CVE-2025-34458
Ubuntu:26.04:LTSdirewolfno fix listedUBUNTU-CVE-2025-34458
Ubuntu:26.10direwolfno fix listedUBUNTU-CVE-2025-34458

Affected products (as reported)

VendorProductVersions
wb2osz Dire Wolf 0 – through 1.8.1

Weakness: CWE-617 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References