MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. (CVE-2026-85447)

The vulnerability in MOOS-IvP pRealm up to version 24.8.1 involves the acceptance of unbounded REALMCAST_REQ subscriptions without proper validation of subscription duration or limits on the variable list size. Attackers can exploit this by registering pipeways that remain active for extended periods and include numerous variables, resulting in continuous excessive output from pRealm. This behavior can exhaust system resources, causing denial of service conditions. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

Successful exploitation leads to resource exhaustion on the affected system due to indefinite excessive output generation, resulting in denial of service. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, consider limiting exposure of the pRealm service to untrusted networks and monitoring for abnormal subscription activity that could indicate exploitation attempts.