CVE-2026-85437 in MOOS-IvP
Summary
by MITRE • 09/04/2026
MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in MOOS-IvP versions up to 24.8.1 represents a critical class of memory corruption issues rooted in improper input validation within the application's string decoding logic. Specifically, the IvP function decoders fail to validate length fields provided by external inputs before processing them. This architectural flaw allows an attacker who can supply or manipulate encoded strings containing mismatched declared and actual field lengths to trigger buffer overflow conditions. These overflows affect both heap-allocated and stack-based buffers within the application's memory space, creating a pathway for arbitrary code execution if the vulnerability is successfully exploited in a network-accessible context.
From a technical perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input Classic and CWE-787 Out-of-bounds Write. The core issue lies in the assumption that length fields embedded within encoded data structures accurately reflect the size of the subsequent payload. When an attacker crafts a malicious string where the declared length exceeds the actual buffer capacity or mismatches the allocated memory region, the decoder proceeds to copy data beyond the intended boundaries. This results in overwriting adjacent memory locations on the stack or heap, which can corrupt control flow data such as return addresses or function pointers. In complex systems like MOOS-IvP, which handles autonomous vehicle path planning and navigation commands via variables and log files, this corruption can lead to severe instability or complete compromise of the host system.
The operational impact of these vulnerabilities is significant due to the nature of MOOS-Middleware's role in marine robotics and unmanned surface vehicles. If an attacker can inject maliciously crafted encoded strings through networked communication channels or by manipulating input data streams that feed into IvP functions, they may achieve remote code execution with the privileges of the running process. This could allow unauthorized control over navigation parameters, disruption of autonomous decision-making processes, or extraction of sensitive operational data stored in memory. The ability to exploit both heap and stack buffers increases the likelihood of successful exploitation across different deployment configurations and operating system environments where MOOS-IvP is utilized for real-time mission-critical tasks.
Mitigation strategies should focus on immediate patching to version 24.8.1 or later, which addresses these validation gaps by implementing strict length checks before buffer operations occur. Developers must ensure that all input data undergoes rigorous sanitization and boundary verification consistent with secure coding standards such as those outlined in CWE-20 Proper Input Validation. Additionally, deploying runtime protection mechanisms like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can mitigate the risk of successful code execution even if a buffer overflow is triggered. For organizations relying on MOOS-IvP for autonomous systems, it is crucial to audit input sources that feed into IvP decoders and restrict access to these interfaces to trusted entities only, thereby reducing the attack surface available to potential adversaries leveraging techniques associated with ATT&CK tactic T1059 Command and Scripting Interpreter or T1203 Exploitation for Client Execution.