Description

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:23.103Z",
  "pubdate": "2026-09-03T23:17:23.103Z",
  "executiveSummary": "MOOS-IvP versions up to 24.8.1 are susceptible to multiple buffer overflow vulnerabilities located within the IvP function string decoders. The vulnerability stems from a lack of input validation regarding length fields contained within encoded strings.\nBy manipulating these length fields, an attacker can trigger memory corruption through mismatched data-to-length declarations, leading to heap or stack overflows. This flaw allows for potential arbitrary code execution under the context of the MOOS application processing the malicious input.\nThese vulnerabilities present a high risk to autonomous systems utilizing the MOOS-IvP middleware, as they can be exploited via crafted MOOS variables transmitted over the network or through malformed alog files processed by system utilities.\nSuccessful exploitation requires the ability to inject malicious strings into the system's communication channels or provide a tainted alog file for parsing. No complex authentication is required if the attacker can influence the input stream of a reachable MOOS process.",
  "technicalDetails": "The root cause of these vulnerabilities is the improper implementation of string decoding logic within the IvP function decoders. The software fails to perform boundary checks, instead placing implicit trust in length metadata provided by the attacker-controlled input string. When the decoder encounters a string where the declared length parameter does not accurately reflect the actual payload size, the underlying memory allocation mechanisms may fail to reserve sufficient space, or conversely, a subsequent copy operation may write past the allocated buffer bounds.\nThe exploitation flow begins with the delivery of a malformed encoded string. This string can be introduced into the system environment via MOOSDB via inter-process communication, or by using offline analysis tools to process a malicious alog file. As the IvP decoder parses this string, it reads the attacker-supplied length field. Because the decoder does not validate this length against the actual capacity of the destination buffer (whether residing on the heap or the stack), it proceeds to perform memory operations, such as memcpy or similar buffer-copying functions, using the untrusted length.\nIf the attacker specifies a length larger than the destination buffer, the resulting operation leads to an out-of-bounds write. In the case of stack-based buffers, this allows for the corruption of stack frames, potentially overwriting return addresses or function pointers, which can be leveraged to redirect control flow to shellcode or return-oriented programming (ROP) chains. For heap-based buffers, the overflow can corrupt adjacent heap metadata or object pointers, which provides a path to arbitrary memory read/write primitives.\nThe impact of these overflows is significant, as MOOS-IvP is often used in sensitive autonomous navigation and control applications. By achieving remote code execution, an attacker could potentially gain full control over the autonomous agent, modify navigational parameters, or intercept sensitive telemetry. The vulnerability is present across all versions of MOOS-IvP up to and including 24.8.1, affecting any component that relies on the flawed IvP string decoding routines for message processing or log file ingestion."
}