CVE-2025-34458 wb2osz/direwolf <= 1.8.1 Reachable Assertion DoS
Remote attackers can cause denial of service in Dire Wolf by sending malformed APRS frames that trigger an assertion failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-34458?
CVE-2025-34458 is a high-severity denial of service vulnerability in wb2osz Dire Wolf, published on 22 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.
Weakness: CWE-617
Which versions are affected by CVE-2025-34458?
How do I fix CVE-2025-34458?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-34458 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34458 exists.
Sources
Also known as DEBIAN-CVE-2025-34458, GHSA-r4wq-665p-whrq, UBUNTU-CVE-2025-34458.