CVE-2026-85438

MOOS-IvP through version 24.8.1 contains a buffer overflow in StringToIvPFunction(), where dimension, piece, and degree counts embedded in encoded BHV_IPF payloads are used directly as allocation sizes and loop bounds without validation. A remote attacker can send a crafted payload with mismatched dimension values, causing attacker-controlled double values to be written past the end of the IvPBox weight array. Successful exploitation results in memory corruption and potentially arbitrary code execution with high impact on confidentiality, integrity, and availability, and the network vector with no privileges or user interaction required means any deployment that accepts MOOS payloads from untrusted network peers is at risk. Anyone running an affected MOOS-IvP release, which is primarily used as autonomy middleware on unmanned marine vehicles and in research/defense autonomy stacks, is affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.5% chance of exploitation in the next 30 days.

What to do: Upgrade to a MOOS-IvP release newer than 24.8.1 as soon as a patched version is available, and monitor the project's advisories. Until then, restrict network access to MOOS-IvP communication ports so only trusted peers can submit BHV_IPF payloads, and audit deployments for whether untrusted sources can reach the StringToIvPFunction() parsing path.