CVE-2026-85437: MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.
Affected Software
Event History
Frequently Asked Questions
What inputs can carry an exploit payload?
The vulnerable decoders can be reached through attacker-crafted MOOS variables or alog files containing encoded strings whose declared field lengths do not match their actual lengths.
Does exploitation require authentication or user interaction?
No. The provided CVSS vector indicates network attack reachability with low attack complexity, no privileges required, and no user interaction.
Which deployments should be treated as affected?
MOOS-IvP versions through 24.8.1 are identified as affected. The data does not state whether any particular default configuration prevents vulnerable string decoding.
What is the likely impact if exploitation succeeds?
The buffer overflows can affect heap and stack buffers and may allow remote code execution. The reported impact includes high confidentiality, integrity, and availability effects.