CVE-2026-85438: MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
Published Sep 3, 2026
·Updated
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.
Affected Software
1 affected component
MOOS-IvP<=24.8.1
Event History
Sep 3, 2026
CVE Published
via MITRE·10:38 PM
Data Sourced
via MITRE·10:38 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be treated as affected?
MOOS-IvP versions through 24.8.1 are affected. The provided information does not identify a fixed release.
2
What access does an attacker need to exploit this issue?
The issue is rated network-accessible with low attack complexity and requires no privileges or user interaction. An attacker must be able to supply a crafted encoded BHV_IPF payload to the vulnerable parsing path.