Executive brief
MOOS-IvP is a set of software modules used to provide autonomous control on robotic platforms, particularly marine vehicles. The system contains multiple buffer overflow vulnerabilities in how it decodes encoded function strings, allowing attackers to craft malicious data that can overflow memory buffers. An attacker can exploit this to achieve remote code execution by injecting malicious MOOS variables or alog files into the system.
Technical details
The vulnerability exists in IvP function string decoders that fail to properly validate length fields in attacker-controlled encoded strings. The decoders trust declared field lengths without validation, allowing mismatches between declared and actual data lengths. This can result in both heap and stack buffer overflows. The attack vector is network-based, as malicious data can be introduced through MOOS variables or alog files. Remote code execution is achievable without authentication requirements. No patch information is currently available from the advisory text.
Affected products
- MOOS-IvP MOOS-IvP through 24.8.1
Timeline
- 2026-09-03: disclosed