MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length… (CVE-2026-85437)

MOOS-IvP versions up to and including 24.8.1 have multiple buffer overflow vulnerabilities in the IvP function string decoders. The root cause is the lack of validation on attacker-controlled length fields, which enables attackers to craft malicious encoded strings with mismatched declared and actual field lengths. This mismatch can overflow heap and stack buffers, potentially allowing remote code execution through MOOS variables or alog files. The vulnerability is tracked as CVE-2026-85437 and is classified under CWE-787 (Out-of-bounds Write). No patch or remediation information is provided in the available data.

Successful exploitation can lead to remote code execution with no privileges required and no user interaction needed. The vulnerability affects confidentiality, integrity, and availability, all rated high impact. This could allow attackers to execute arbitrary code remotely, compromising affected systems running MOOS-IvP through 24.8.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted MOOS variables or alog files that could contain malicious encoded strings. Monitor vendor channels for updates and apply patches promptly once released.