CVE-2026-85445

Received Received - Intake

Denial of Service in MOOS-IvP via Unbounded Memory Allocation

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85445

Affected Vendors & Products

Vendor	Product	Version / Range
moos-ivp	moos-ivp	to 24.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

MOOS-IvP through version 24.8.1 has a denial of service vulnerability in the Demuxer::addMuxPacket() function. The issue occurs because the function trusts the packet count declared in mux headers without validating it. Attackers can exploit this by declaring an extremely large packet count, which causes the system to allocate excessive memory, leading to resource exhaustion and service unavailability.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or crashes in MOOS-IvP applications. Check for processes consuming excessive memory or logs indicating failed memory allocations. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory usage patterns in MOOS-IvP related processes.

Impact Analysis

This vulnerability can cause your system to run out of memory and crash, making services unavailable. It may lead to downtime for applications relying on MOOS-IvP, disrupting operations that depend on this software for data processing or communication.

Compliance Impact

This vulnerability causes denial of service through resource exhaustion, which may lead to service unavailability. While not directly tied to data breaches, prolonged unavailability could impact systems handling sensitive data, potentially affecting compliance with standards like GDPR (availability principle) or HIPAA (accessibility requirements).

Mitigation Strategies

Immediately update MOOS-IvP to the latest version (24.8.1 or later) where this issue is resolved. If updating is not possible, restrict network access to MOOS-IvP services to trusted sources only and monitor for unusual traffic patterns that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-85445. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70