MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files… (CVE-2026-85456)

MOOS-IvP through version 24.8.1 fails to properly validate variable names extracted from alog files within the SplitHandler. Specifically, attackers can supply specially crafted alog files containing backslash sequences in variable names, which are used to escape the designated output directory. This improper validation allows attackers on Windows systems to write or append to arbitrary files outside the intended directory, constituting a directory traversal and arbitrary file write vulnerability (CWE-22).

The vulnerability allows an attacker to write files outside the designated split directory by exploiting improper validation of variable names in alog files. This can lead to unauthorized modification or appending of arbitrary files on Windows systems, impacting the integrity of files. There is no direct confidentiality or availability impact reported. The CVSS v3.1 score is 5.5 (medium severity), reflecting low attack vector (local), low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a fix is released, users should avoid processing untrusted alog files or restrict access to the SplitHandler component to trusted users only.