MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust… (CVE-2026-85449)

The vulnerability in MOOS-IvP pMarineViewer up to version 24.8.1 involves a failure to limit the number of tracked node identities from NODE_REPORT messages. Attackers can exploit this by sending crafted NODE_REPORT data with unbounded distinct node names, leading to memory exhaustion and causing the operator display to stall. No authentication is required to exploit this issue. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges or user interaction needed, and an impact limited to availability (memory exhaustion).

An attacker can cause a denial of service by exhausting memory resources on the system running pMarineViewer, resulting in the operator display stalling. This impacts availability but does not affect confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the pMarineViewer service to trusted networks to reduce exposure to unauthenticated attacks.