CVE-2026-85449

MOOS-IvP pMarineViewer, the operator display for the open-source MOOS-IvP marine-robotics autonomy suite, does not cap the number of node identities it tracks from NODE_REPORT messages (CWE-770), so unbounded distinct node names accumulate in memory. An attacker with network reachability to the MOOS community can publish crafted NODE_REPORT data without authentication, causing unbounded memory growth. The outcome is memory exhaustion that stalls the operator display (high availability impact); confidentiality and integrity are not affected. All deployments of pMarineViewer up to and including version 24.8.1 are affected, primarily academic, naval, and research marine-robotics teams. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only a ~0.4% probability of exploitation within 30 days.

What to do: Upgrade MOOS-IvP/pMarineViewer to a release newer than 24.8.1 once a patched build is published, since no fixed version is specified in the advisory data. Until then, restrict network access to the MOOS community and viewer connections to trusted subnets or authenticated operators, and monitor the viewer process for abnormal memory growth, restarting it if the display stalls.