External risk intelligence

MOOS-IvP StringToIvPFunction Buffer Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85438

MOOS-IvP is an open-source software project used primarily for autonomous marine robotics and research simulations. It is not an internet-facing web application, edge gateway, or public service. Deployments are typically localized to onboard systems or research networks, making public internet exposure and reachability very unlikely.

Integer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in MOOS-IvP, a software suite used in marine robotics, that could allow attackers to execute code if they can send specially crafted data. The vulnerability stems from insufficient validation of payload data, potentially leading to memory corruption. The main concern is confirming relevance and exposure within your specific deployments.

Unvalidated data can cause system memory corruption.
Critical flaw in marine robotics software requires attention.
Assess impact; ensure relevance to your operations.

Attack Path

How an attacker could exploit the issue

An attacker with network access can send specially crafted payloads to the MOOS-IvP system. The system processes counts from these payloads without proper validation, leading to memory corruption within the `StringToIvPFunction()` component, potentially allowing for code execution.

No specific access required.
Unvalidated payload counts trigger overflow.
Risk of memory corruption and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary code when unvalidated payload counts are used as allocation sizes and loop bounds in specific MOOS-IvP functions. This memory corruption could lead to a compromise of the system's integrity and availability.

System integrity and execution flow.
Mismatched payload counts causing memory corruption.
Potential for arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The MOOS-IvP project's StringToIvPFunction() component is vulnerable to a buffer overflow. This vulnerability requires a crafted payload to exploit, and given MOOS-IvP's typical use in localized research or onboard marine robotics systems, external reachability is unlikely. The first practical step is to identify any instances of MOOS-IvP, confirm their exposure and criticality, and then coordinate with the relevant teams for remediation planning.

Identify MOOS-IvP instances.
Verify reachability and criticality.
Plan remediation with accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MOOS-IvP?

MOOS-IvP is an open-source software suite designed for autonomous marine robotics and research simulations. It provides a framework for coordinating vehicles and sensors, often powering the intelligence and decision-making logic on underwater or surface vessels. Because it manages complex mission data, it is a specialized tool used primarily in research and onboard control systems rather than general-purpose computing.

What does the CVE-2026-85438 vulnerability mean?

This vulnerability is a buffer overflow, specifically classified as an integer-related issue. It occurs because the software fails to verify numerical data—specifically dimension and piece counts—received in certain payloads. By providing mismatched numbers, an attacker can trick the system into allocating incorrect memory sizes and writing data beyond the intended storage boundaries, which corrupts memory and could allow unauthorized code execution.

How is this buffer overflow triggered in MOOS-IvP?

The flaw is triggered when the StringToIvPFunction receives a specially crafted BHV_IPF payload containing invalid count values. The system uses these values directly as bounds for memory allocation and loops. If the payload is well-formed and uses valid, matching dimension values, this specific error condition does not occur; the issue strictly requires the processing of malicious, mismatched counts to cause the overflow.

Who should care about CVE-2026-85438?

Organizations using MOOS-IvP should assess their systems, though Halo Surface Signal notes that public internet exposure is very unlikely. Since the software is typically found in localized research networks or onboard marine vehicles, it is rarely exposed to the open web. However, if your specific implementation involves network-accessible interfaces that process these payloads, your risk profile increases significantly.

What should I do if I use this software?

The first step is to conduct an inventory of all MOOS-IvP instances within your environment to identify versions up to 24.8.1. Once identified, verify if those systems are reachable via your internal networks or other data links. Coordinate with your technical teams to monitor for official updates from the project and plan for an orderly deployment of any patches to remediate the vulnerability in your robotics or simulation systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.