Description

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.320Z",
  "pubdate": "2026-09-03T23:17:24.320Z",
  "executiveSummary": "A denial-of-service (DoS) vulnerability exists in MOOS-IvP through version 24.8.1, stemming from improper input validation within the Demuxer component.\nThe vulnerability is characterized by an unbounded memory allocation flaw triggered by a failure to verify packet count parameters in the mux header.\nAn unauthenticated, remote attacker can exploit this weakness by crafting a malicious mux packet containing an arbitrarily large packet count field.\nUpon processing this malformed header, the application attempts to allocate memory proportional to the attacker-supplied value, leading to severe resource exhaustion, heap fragmentation, or total system instability.\nThis vulnerability presents a significant risk to the availability of MOOS-IvP-based autonomous systems, as it allows for the forced termination of critical processes without requiring privileged access or complex authentication.\nSuccessful exploitation results in service unavailability, potentially compromising mission-critical operations relying on the MOOS-IvP framework.",
  "technicalDetails": "The vulnerability resides in the Demuxer::addMuxPacket() function, which is responsible for processing incoming mux-encoded data streams. The core of the issue is an trust-based validation logic failure regarding the packet count field declared within the mux header.\nWhen a mux packet is received, the Demuxer component parses the header to determine the number of constituent packets contained within the transmission. Critically, the implementation utilizes this externally supplied integer to allocate memory buffers or initialize data structures intended to hold the incoming packet sequence.\nBecause the Demuxer::addMuxPacket() function does not perform bounds checking or sanity verification against the declared packet count, it remains susceptible to integer-based resource exhaustion attacks.\nThe attack flow follows a deterministic progression: 1) The attacker constructs a malicious mux packet where the header's 'packet count' field is set to a near-maximum integer value. 2) The attacker transmits this payload to a target instance of MOOS-IvP. 3) The Demuxer::addMuxPacket() function parses the header and accepts the untrusted value as a legitimate allocation request. 4) The application attempts to allocate memory heap space commensurate with the large count. 5) The underlying operating system or the application's memory allocator experiences an allocation failure or severe memory pressure as it attempts to satisfy the unbounded request.\nThis behavior induces a DoS condition due to uncontrolled memory growth. Depending on the system architecture and memory availability, this will trigger either an out-of-memory (OOM) crash, leading to process termination, or extreme latency during heap management, effectively halting the functionality of the autonomous vehicle or swarm control logic. The vulnerability affects MOOS-IvP through version 24.8.1 and necessitates no prior authentication or administrative privileges, as the vulnerability manifests at the packet processing layer. The exposure is largely dependent on the network accessibility of the MOOS-IvP communication endpoints; however, any reachable interface processing mux traffic is considered vulnerable to this vector."
}