CVE-2026-85444 in MOOS-IvP
Summary
by MITRE • 09/04/2026
MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The MOOS-IvP software suite, specifically through version 24.8.1, contains a critical input validation flaw within its message parsing logic that leads to an out-of-bounds memory read vulnerability. This issue resides in the string processing functions isQuoted(), isBraced(), and isChevroned(), which are designed to identify and strip leading or trailing whitespace from incoming data strings before further processing. The core technical deficiency arises because these functions calculate their internal indexing bounds based on the length of the original, untrimmed input string rather than the reduced length after whitespace removal. Consequently, when an attacker provides a NODE_REPORT message containing significant amounts of leading or trailing whitespace, the parsing logic attempts to access memory locations that lie beyond the actual valid data buffer boundaries. This discrepancy between the logical index and the physical buffer size creates a classic off-by-one or similar boundary violation condition that allows for unauthorized memory access.
From an operational perspective, this vulnerability poses a significant risk to system stability and potentially security posture depending on how the accessed adjacent memory is utilized by subsequent code paths. Reading past buffer bounds can lead to information disclosure if the adjacent memory contains sensitive data such as credentials, internal state variables, or other process-specific secrets that are not intended for external exposure. Furthermore, in many programming environments, accessing invalid memory addresses often triggers segmentation faults or access violations, resulting in immediate application crashes and denial of service conditions. In more complex exploitation scenarios where the read operation influences control flow or is part of a larger chain involving subsequent writes, this flaw could potentially be leveraged to achieve arbitrary code execution, although the primary manifestation described here is an information leak or crash vector. The vulnerability affects components responsible for handling NODE_REPORT messages, which are central to the communication architecture of MOOS-IvP, thereby impacting the reliability of autonomous vehicle coordination systems that rely on this framework.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-125: Out-of-bounds Read, as it involves reading data from a memory location outside the intended buffer boundary due to improper calculation of array indices or string lengths. Additionally, given that the vulnerability is triggered by sending specifically crafted NODE_REPORT messages over the network interface, it falls under MITRE ATT&CK technique T1059: Command and Scripting Interpreter if interpreted as part of an initial access vector where malformed inputs are used to probe for weaknesses in command-line or script-based interfaces. It also relates to CWE-20: Improper Input Validation because the system fails to correctly validate that the processed string length matches the allocated buffer constraints after transformation operations like whitespace stripping.
To mitigate this vulnerability, developers must ensure that all input processing functions strictly adhere to bounds checking based on the actual data size post-transformation rather than pre-transformation metrics. Specifically, the isQuoted(), isBraced(), and isChevroned() functions should be refactored to recalculate string lengths after whitespace removal or to use safe string handling libraries that automatically manage buffer boundaries. Implementing strict input validation at the entry point of message parsing can prevent malformed packets from reaching these vulnerable code paths. For users unable to immediately patch their systems, deploying network-level intrusion detection signatures that identify NODE_REPORT messages with excessive leading or trailing whitespace can provide a temporary layer of defense by blocking potentially malicious inputs before they are processed by the application logic. Regular security audits focusing on string manipulation routines and buffer management practices are recommended to prevent similar off-by-one errors in future development cycles.