Cyber & AI intelligence
Wasteland.
Briefs indexed2403
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85438 2026-09-03

CVE-2026-85438: Critical Buffer Overflow in MOOS-IvP Autonomy Payload Decoder

"A critical out-of-bounds write in MOOS-IvP through version 24.8.1 lets an unauthenticated remote attacker corrupt memory, and potentially execute code, by sending a crafted BHV_IPF payload. The CNA rates it CVSS 3.1 9.8."

A critical out-of-bounds write in MOOS-IvP through version 24.8.1 lets an unauthenticated remote attacker corrupt memory, and potentially execute code, by sending a crafted BHV_IPF payload. The CNA rates it CVSS 3.1 9.8.

One caveat before the technical detail: the identifier as published, CVE-2026-85438, sits far above the sequence numbers currently being issued for 2026; assignments at the time of writing are in the five-digit low range (CVE-2026-1xxxx). The identifier should be confirmed against the NVD record before it is used for tracking, ticketing, or downstream correlation; the underlying advisory and code references below are the durable part of this report.

What Is It

The vulnerability is a buffer overflow in StringToIvPFunction(), the routine that decodes encoded BHV_IPF payloads in MOOS-IvP. The dimension, piece, and degree counts carried in the payload are consumed directly as allocation sizes and loop bounds with no validation. An attacker who supplies mismatched dimension values can drive the decode loop past the end of the allocated IvPBox weight array and write attacker-controlled doubles into adjacent memory, producing memory corruption and potential code execution.

The issue is an out-of-bounds write (CWE-787) and was disclosed by VulnCheck. The vulnerable code path is in ivp/src/lib_ivpbuild/FunctionEncoder.cpp.

Why It Matters

The severity metrics come from the CNA rather than from completed NVD analysis. The CVSS 3.1 base score is 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. The CVSS 4.0 score is 9.3 (CRITICAL) with the same unauthenticated-remote exposure profile. Both scores may shift once NVD enrichment finishes.

In practical terms, anything that accepts and decodes an IvP function payload can be attacked by whoever can reach it. There is no authentication step to clear and no victim action required, and the primitive, writing controlled doubles past a heap buffer, is the kind that tends to be weaponizable rather than merely a crash.

What's Vulnerable

No CPE entries were assigned in the NVD record at time of writing, so automated inventory matching will not fire on this CVE yet. Identify exposure by source tree and version rather than by CPE.

Patch Status

The NVD record was published 2026-09-03 with a status of "Received," meaning NVD analysis is not yet complete; the affected-version range, CWE mapping, and scores above are as supplied by the CNA and have not been independently validated by NVD. This CVE does not appear in the CISA KEV catalog: there is no confirmation of active exploitation and no federal required-action deadline associated with it.

Upstream references point to a fix: commit 85f4653 and pull request #126 in the moos-ivp repository. Operators running 24.8.1 or earlier should track that commit and update accordingly.

Sources