VYPR
advisoryPublished Sep 3, 2026· Updated Sep 4, 2026· 1 source

Moos Ivp: 16 Vulnerabilities Including RCE and DoS Disclosed Together

Key findings • 16 vulnerabilities disclosed for Moos Ivp on September 3, 2026, ranging from Medium to Critical severity. • Multiple critical vulnerabilities allow for remote code execution th…

Key findings

  • 16 vulnerabilities disclosed for Moos Ivp on September 3, 2026, ranging from Medium to Critical severity.
  • Multiple critical vulnerabilities allow for remote code execution through buffer overflows and shell metacharacter injection.
  • Several flaws enable denial of service by exhausting server resources through unbounded connections, memory allocation, or processing.
  • Data integrity and confidentiality are at risk due to vulnerabilities allowing unauthorized data access and redirection.
  • Affected versions include Moos Ivp through 24.8.1 and MOOS core-moos through 10.4.0; patching is strongly advised.

On September 3, 2026, a significant batch of 16 vulnerabilities was disclosed for Moos Ivp, a middleware software used in maritime robotics and autonomous systems. These vulnerabilities, ranging in severity from Medium to Critical, were all published on the same day, indicating a coordinated disclosure event. The flaws primarily stem from insufficient input validation and improper handling of attacker-controlled data within various Moos Ivp components, potentially leading to remote code execution, denial of service, and unauthorized data access.

Several vulnerabilities center on resource exhaustion and denial of service. CVE-2026-85450 highlights a DoS flaw in the MOOSDB HTTP server, which can be exploited by opening numerous connections and sending excessive header data to exhaust server threads and memory. Similarly, CVE-2026-85449 and CVE-2026-85448 describe how unbounded node identities and community names, respectively, can lead to memory exhaustion in pMarineViewer and uFldShoreBroker. CVE-2026-85447 details how pRealm can be tricked into generating excessive output due to unbounded REALMCAST_REQ subscriptions, and CVE-2026-85445 points to a DoS vulnerability in Demuxer::addMuxPacket() where a declared packet count is used for unbounded memory allocation. CVE-2026-85446 describes a quadratic processing vulnerability in uFldNodeComms, triggered by an unbounded number of distinct node names, which can delay or halt shoreside broker operations.

A critical theme across multiple CVEs is the potential for remote code execution (RCE) and arbitrary file write vulnerabilities. CVE-2026-85456 allows attackers to write files outside the intended directory by exploiting improper validation of variable names in alog files within SplitHandler. More severe RCE vulnerabilities include CVE-2026-85439, where shell metacharacters in log file names or directory parameters for alogsplit's SplitHandler can lead to arbitrary command execution. CVE-2026-85438 and CVE-2026-85437 detail buffer overflow vulnerabilities in IvP function string decoders and StringToIvPFunction, respectively, which can be triggered by crafted payloads with incorrect length fields, potentially allowing for arbitrary code execution. Furthermore, CVE-2026-85426 in uMemWatch and CVE-2026-85425 in iSay allow for arbitrary command execution by injecting shell metacharacters into client names or SAY_MOOS messages, respectively.

Several vulnerabilities also impact the integrity and confidentiality of data through man-in-the-middle-like attacks and data redirection. CVE-2026-85435 and CVE-2026-85434 describe flaws in uFldNodeBroker and uFldShoreBroker, respectively, that allow attackers to enroll attacker-controlled shore routes or redirect bridged vehicle traffic by publishing malicious messages without proper source validation. CVE-2026-85429 enables attackers to impersonate other nodes by crafting NODE_MESSAGE packets with spoofed source identities. Additionally, CVE-2026-85444 points to a buffer over-read vulnerability in whitespace stripping functions, which could allow access to adjacent memory when processing NODE_REPORT messages with leading or trailing whitespace.

The affected versions for most of these vulnerabilities are listed as through 24.8.1 for Moos Ivp components, and through 10.4.0 for the MOOS core-moos. Patches or updated versions addressing these issues are expected to be released by the vendor. Users are advised to update to the latest available versions as soon as possible to mitigate these risks. The coordinated disclosure of these numerous vulnerabilities underscores the importance of rigorous security practices and timely patching for critical infrastructure software like Moos Ivp.

The sheer number and severity of these vulnerabilities, particularly those enabling remote code execution and denial of service, highlight a critical need for users of Moos Ivp to prioritize updating their systems. The interconnected nature of these flaws, often stemming from similar root causes like insufficient input validation, suggests a need for a comprehensive review of the software's security architecture. Users should consult official Moos Ivp advisories for specific patch versions and mitigation strategies.

CVE-2026-85456 CVE-2026-85450 CVE-2026-85449 CVE-2026-85448 CVE-2026-85447 CVE-2026-85446 CVE-2026-85445 CVE-2026-85444 CVE-2026-85439 CVE-2026-85438 CVE-2026-85437 CVE-2026-85435 CVE-2026-85434 CVE-2026-85429 CVE-2026-85426 CVE-2026-85425

Synthesized by Vypr AI