Buffer Overflow Vulnerabilities in MOOS-IvP Affected by Unsafe String Decoders

CVE-2026-85437

What is CVE-2026-85437?

The MOOS-IvP version 24.8.1 and prior contains multiple buffer overflow vulnerabilities in its IvP function string decoders. These vulnerabilities arise from the lack of validation for attacker-controlled length fields, enabling potential exploitation. By crafting malicious encoded strings with discrepancies between declared and actual field lengths, attackers could manipulate heap and stack buffers. This may lead to remote code execution via MOOS variables or log files, posing significant security risks.

References