CVE-2026-85447

Received Received - Intake

MOOS-IvP pRealm Unbounded Subscription Resource Exhaustion

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-lived pipeways with many variables to cause pRealm to generate excessive output indefinitely, exhausting system resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85447

Affected Vendors & Products

Vendor	Product	Version / Range
moos-ivp	prealm	to 24.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

MOOS-IvP pRealm through version 24.8.1 has a flaw where it accepts REALMCAST_REQ subscriptions without checking the duration or number of variables. Attackers exploit this by creating long-lived subscriptions with many variables, causing pRealm to generate excessive output indefinitely. This leads to system resource exhaustion.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive pipeway subscriptions in MOOS-IvP pRealm. Check for unusually high numbers of REALMCAST_REQ subscriptions or sustained high output rates. Use system monitoring tools like netstat, lsof, or MOOS-IvP logs to identify abnormal pipeway activity. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause system crashes or slowdowns due to resource exhaustion. It may disrupt services relying on pRealm, leading to downtime or degraded performance. Attackers could leverage this to deny service to legitimate users.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting system resources, which may impact availability of services handling sensitive data. For GDPR, this could affect the right to access or availability of services. For HIPAA, it may disrupt critical healthcare systems. However, specific compliance impacts depend on system configuration and data processing context.

Mitigation Strategies

Update MOOS-IvP pRealm to version 24.8.1 or later to address the unbounded subscription issue. Monitor system resource usage for abnormal pipeway or variable subscriptions. Restrict network access to pRealm services to trusted sources only.

Hi! I’m here to help you understand CVE-2026-85447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70