Description

MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.180Z",
  "pubdate": "2026-09-03T23:17:24.180Z",
  "executiveSummary": "MOOS-IvP through version 24.8.1 is susceptible to a buffer over-read vulnerability within its string manipulation routines. The issue manifests in the isQuoted(), isBraced(), and isChevroned() functions, which fail to correctly synchronize indices when processing strings that contain leading or trailing whitespace. This flaw allows a remote attacker to trigger an out-of-bounds memory access by injecting specifically crafted NODE_REPORT messages.\nThe vulnerability allows for the leakage of adjacent memory contents, potentially exposing sensitive data residing in the application's heap or stack. Because MOOS-IvP is often used in autonomous underwater vehicle (AUV) systems and collaborative robotics, successful exploitation could lead to critical information disclosure. There are no authentication requirements for this attack, as the processing of external messages typically occurs within the MOOS communications framework. The risk is significant, as it enables an attacker to probe the memory space of a deployed robotics process without needing prior system access.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of bounds checking within string processing utility functions: isQuoted(), isBraced(), and isChevroned(). These functions are designed to validate string delimiters after stripping whitespace; however, they perform index calculations based on the length of the original, un-stripped string while attempting to access indices relative to the modified, whitespace-trimmed state.\nIn the event that an input string contains leading or trailing whitespace, the whitespace-stripping logic updates the start and end pointers of the string data. Subsequent logic in these functions fails to adjust the loop boundaries or bounds checks accordingly. Consequently, the functions reference the original string length to determine the upper limit of the traversal, rather than the length of the sanitized string. When a malicious NODE_REPORT is received containing specific whitespace padding, the internal index can point to memory addresses immediately following the allocated buffer of the string.\nThe exploitation flow begins with an attacker crafting a NODE_REPORT message. This message is injected into the MOOS communications network, where it is received and parsed by the target process. When the parsing logic invokes one of the affected functions, the over-read is triggered. Because these functions iterate over the provided buffer, the over-read permits the reading of adjacent memory bytes that were not intended to be accessed during the validation routine. By observing the responses or error logs—or through side-channel analysis—an attacker may successfully exfiltrate the contents of adjacent memory segments.\nThis vulnerability is present in all versions of MOOS-IvP up to and including 24.8.1. The attack requires no authentication, as the vulnerable functions are part of the core message-handling infrastructure exposed to the network. The impact is primarily limited to information disclosure; however, in complex memory layouts, this may facilitate the discovery of function pointers or sensitive data structures that could be leveraged in further exploit chains. The flaw highlights a critical failure in maintaining index-to-pointer consistency when performing destructive string operations."
}