Description

MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T23:17:24.900Z",
  "pubdate": "2026-09-03T23:17:24.900Z",
  "executiveSummary": "MOOS-IvP pMarineViewer versions up to and including 24.8.1 are susceptible to an unbounded memory exhaustion vulnerability caused by improper handling of NODE_REPORT message inputs.\nThe vulnerability allows an unauthenticated remote attacker to craft and inject malicious NODE_REPORT data, which the application fails to limit or sanitize regarding the number of tracked node identities.\nBy flooding the application with a high volume of unique, distinct node names, an attacker can force the pMarineViewer process to consume excessive system memory.\nThis leads to a denial-of-service (DoS) condition, resulting in application instability, memory exhaustion, and a complete stall of the operator display.\nThe impact is significant as pMarineViewer is critical for situational awareness in autonomous vehicle swarms, and the lack of authentication requirements makes it a high-risk vector for malicious actors on the shared MOOS network.\nExploitation does not require prior system access, relying solely on the ability to publish messages to the MOOS community database.",
  "technicalDetails": "The vulnerability resides within the pMarineViewer component of the MOOS-IvP framework, which is responsible for visualizing node-related telemetry data, specifically NODE_REPORT messages.\nThe root cause of the vulnerability is the lack of a defined upper bound or threshold management system when the application parses and stores unique identities contained within NODE_REPORT payloads.\nWhen pMarineViewer receives a NODE_REPORT, it registers the node identity to facilitate real-time tracking and display; however, the implementation fails to enforce a maximum limit on the internal collection or registry of these identities.\nAn attacker can exploit this by programmatically publishing a large sequence of NODE_REPORT messages, each containing a unique and randomized node name, directly to the MOOS community (MOOSDB).\nBecause the application dynamically allocates memory for each unique node discovered, the continuous influx of novel identifiers forces the pMarineViewer process to expand its heap memory usage indefinitely.\nAs memory exhaustion approaches, the system experiences significant latency, thrashing, and eventual process suspension or termination, which halts the critical operator interface.\nThis attack flow is effective because MOOS community participants often share a common communication bus where subscribers like pMarineViewer process all incoming messages indiscriminately.\nThere are no authentication mechanisms natively enforced by the MOOS middleware for message publication, enabling any compromised or unauthorized node within the network to flood the pMarineViewer instance without requiring elevated privileges.\nThe vulnerability affects all versions up to 24.8.1 and exposes the application to remote denial-of-service, rendering the visualization tool unusable for human operators who rely on accurate telemetry data for mission management.\nPost-exploitation, the target process remains in a stalled or crashed state until the MOOSDB is cleared or the pMarineViewer instance is manually restarted, resulting in a persistent loss of operational visibility."
}