Description

MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-03T23:17:23.270Z",
  "pubdate": "2026-09-03T23:17:23.270Z",
  "executiveSummary": "MOOS-IvP through version 24.8.1 is susceptible to a critical buffer overflow vulnerability within the StringToIvPFunction() routine.\nThe vulnerability stems from improper validation of metadata fields—specifically dimension, piece, and degree counts—extracted from encoded BHV_IPF payloads.\nAn unauthenticated attacker can supply a maliciously crafted payload to trigger an out-of-bounds write operation, overwriting memory beyond the allocated IvPBox weight array.\nSuccessful exploitation facilitates arbitrary memory corruption, which may lead to application crashes, denial-of-service conditions, or potential arbitrary code execution within the context of the affected process.\nThis flaw poses a significant risk to the integrity and availability of systems relying on MOOS-IvP for autonomous vehicle coordination and mission control.\nThe vulnerability is exploitable by remote attackers capable of delivering crafted payload data to the processing logic, necessitating immediate attention to input sanitization and memory safety boundaries.",
  "technicalDetails": "The vulnerability resides in the StringToIvPFunction() function, which is responsible for parsing and deserializing BHV_IPF (IvP Function) payloads in MOOS-IvP through 24.8.1.\nThe root cause is a failure to perform bounds checking on user-supplied metadata fields, specifically the dimension, piece, and degree parameters, before they are utilized as allocation sizes and loop control variables.\nWhen a payload is processed, the function extracts these values from the serialized input without verifying their relationship to the actual memory footprint of the underlying data structures, such as the IvPBox weight array.\nAn attacker can exploit this by constructing a BHV_IPF payload where the reported dimensions do not correlate with the provided data buffer. By supplying mismatched or excessively large dimension values, the attacker induces the function to perform memory allocations or iteration cycles based on attacker-influenced parameters.\nThe subsequent memory access pattern involves using these controlled values as offsets or indices when performing write operations to the IvPBox weight array. Since the function lacks sufficient validation, these writes occur outside the intended memory region allocated for the array.\nThe attack flow follows these stages: 1) The attacker injects a malformed BHV_IPF string into the communication interface processed by the vulnerable node. 2) StringToIvPFunction() parses the string and extracts the malicious metadata. 3) The function logic allocates memory or enters a loop using the untrusted, high-value dimension identifiers. 4) During the payload processing, the code writes double-precision floating-point values into memory addresses beyond the buffer boundary.\nThe resulting memory corruption can overwrite adjacent object pointers, function return addresses, or other sensitive control structures in the heap. This allows for the redirection of execution flow or the subversion of internal logic, potentially leading to remote code execution. Given the nature of MOOS-IvP, which is often deployed in autonomous vehicle control systems, this vulnerability could be leveraged to manipulate mission behavior or disable safety-critical software modules."
}