CVE-2026-85444: MOOS-IvP through 24.8.1 Out-of-Bounds Read in isBraced, isQuoted and isChevroned
Published Sep 3, 2026
·Updated
MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODEREPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.
Affected Software
1 affected component
MOOS-IvP<=24.8.1
Event History
Sep 3, 2026
CVE Published
via MITRE·10:38 PM
Data Sourced
via MITRE·10:38 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker able to send NODE_REPORT messages to a vulnerable MOOS-IvP instance can trigger the out-of-bounds read. No authentication or user interaction is required according to the supplied vector.
2
What input is needed to trigger the flaw?
NODE_REPORT messages containing leading or trailing whitespace can cause the affected parsing functions to read past the buffer boundary.
3
Which versions are affected?
MOOS-IvP versions through 24.8.1 are affected.