CVE-2026-85444

MOOS-IvP through 24.8.1 contains a buffer over-read (CWE-125) in the isQuoted(), isBraced(), and isChevroned() helper functions, which strip surrounding whitespace but index into the buffer using the original string length, so the code can read past the end of the buffer into adjacent memory. An attacker triggers the flaw by sending a NODE_REPORT message with leading or trailing whitespace to a network-reachable MOOS-IvP component that parses it. According to the CVSS 4.0 vector (AV:N/PR:N/UI:N with VA:H), the primary attacker gain is a high-impact availability failure — crashing the parsing process — with no stated confidentiality or integrity impact. Any deployment running MOOS-IvP version 24.8.1 or earlier, particularly where message handling is reachable from a network interface, is affected. Exploitation status is currently none known: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.4%.

What to do: Plan to upgrade MOOS-IvP to a release newer than 24.8.1 as soon as a patched version is published. Until then, restrict network access to MOOSDB and any applications that process NODE_REPORT messages (e.g., allow only trusted peers on the MOOS community's network ports), and trim or sanitize leading/trailing whitespace in incoming MOOS messages where feasible. Monitor autonomy processes for unexplained crashes or restarts, since the expected impact is process termination rather than data theft.