A set of unvalidated length fields in MOOS-IvP's IvP function string decoders lets attackers overflow heap and stack buffers and potentially execute code remotely on affected marine autonomy systems.
What Is It
CVE-2026-85437 covers multiple buffer overflow vulnerabilities (CWE-787, out-of-bounds write) in the IvP function string decoders shipped with MOOS-IvP. The decoders trust attacker-controlled length fields in encoded strings without validating them. By crafting an encoded string whose declared field length does not match its actual length, an attacker can overflow both heap and stack buffers. The NVD record notes this can potentially lead to remote code execution delivered through MOOS variables or alog files.
Why It Matters
The flaw carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (CRITICAL). The vector describes a network attack vector, low attack complexity, no required privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Because the malicious input can arrive as a MOOS variable or inside an alog file, any component that decodes IvP function strings from an untrusted or reachable source is exposed.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.
What's Vulnerable
- Vendor/product: moos-ivp / moos-ivp
- Affected versions: all versions through 24.8.1 (
<= 24.8.1); other versions are listed as unaffected by default - Affected component: IvP function string decoders, referenced in
ivp/src/lib_ivpbuild/FunctionEncoder.cpp
No CPE entries were published in the NVD record.
Patch Status
The NVD references include an upstream commit (81ca795fcfd62b42002d277f5a2390f4c8ab8c7f) and pull request #125 in the moos-ivp repository, indicating a fix exists in the project's source tree. Operators running 24.8.1 or earlier should track that commit and PR and update to a build containing the fix. The record was published 2026-09-03 with a status of "Received," meaning NVD analysis is not yet complete.
Sources
- NVD, CVE-2026-85437: https://nvd.nist.gov/vuln/detail/CVE-2026-85437
- VulnCheck Advisory; MOOS-IvP through 24.8.1 buffer overflow in IvP function string decoders: https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-buffer-overflow-in-ivp-function-string-decoders
- MOOS-IvP repository: https://github.com/moos-ivp/moos-ivp
- Affected code; FunctionEncoder.cpp: https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/lib_ivpbuild/FunctionEncoder.cpp#L310
- Fix commit: https://github.com/moos-ivp/moos-ivp/commit/81ca795fcfd62b42002d277f5a2390f4c8ab8c7f
- Pull request #125: https://github.com/moos-ivp/moos-ivp/pull/125