Cyber & AI intelligence
Wasteland.
Briefs indexed2403
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85437 2026-09-03

CVE-2026-85437: Critical Buffer Overflows in MOOS-IvP Autonomy Function Decoders

"A set of unvalidated length fields in MOOS-IvP's IvP function string decoders lets attackers overflow heap and stack buffers and potentially execute code remotely on affected marine autonomy systems."

A set of unvalidated length fields in MOOS-IvP's IvP function string decoders lets attackers overflow heap and stack buffers and potentially execute code remotely on affected marine autonomy systems.

What Is It

CVE-2026-85437 covers multiple buffer overflow vulnerabilities (CWE-787, out-of-bounds write) in the IvP function string decoders shipped with MOOS-IvP. The decoders trust attacker-controlled length fields in encoded strings without validating them. By crafting an encoded string whose declared field length does not match its actual length, an attacker can overflow both heap and stack buffers. The NVD record notes this can potentially lead to remote code execution delivered through MOOS variables or alog files.

Why It Matters

The flaw carries a CVSS v3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 score of 9.3 (CRITICAL). The vector describes a network attack vector, low attack complexity, no required privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. Because the malicious input can arrive as a MOOS variable or inside an alog file, any component that decodes IvP function strings from an untrusted or reachable source is exposed.

No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.

What's Vulnerable

No CPE entries were published in the NVD record.

Patch Status

The NVD references include an upstream commit (81ca795fcfd62b42002d277f5a2390f4c8ab8c7f) and pull request #125 in the moos-ivp repository, indicating a fix exists in the project's source tree. Operators running 24.8.1 or earlier should track that commit and PR and update to a build containing the fix. The record was published 2026-09-03 with a status of "Received," meaning NVD analysis is not yet complete.

Sources