CVE-2026-85445

MOOS-IvP through 24.8.1 is affected by a remote denial-of-service flaw in the Demuxer::addMuxPacket() function, which trusts the packet count declared in mux packet headers without validating it (CWE-789, memory allocation with excessive size value). An attacker who can send network traffic to a process that demultiplexes MOOS mux packets can declare an arbitrarily large packet count, causing the demuxer to attempt an unbounded memory allocation. The allocation exhausts system memory and other resources, rendering the affected service or application unavailable; the CVSS 4.0 vector shows high availability impact with no confidentiality or integrity impact. Affected operators are users of the MOOS-IvP open-source marine robotics autonomy suite, including onboard vehicle autonomy software and shore-side applications that accept mux packets over the network, on releases through 24.8.1. There is currently no known public proof-of-concept, no reported in-the-wild exploitation (not in CISA KEV), and a low exploitation probability (EPSS 0.4% over 30 days).

What to do: Upgrade MOOS-IvP to a release newer than 24.8.1 when a fixed version is published and confirm with upstream that Demuxer::addMuxPacket() now validates declared packet counts. Until patched, restrict network access to MOOS communication endpoints so only trusted hosts can send mux packets, and monitor affected processes for abnormal memory growth.