Is CVE-2026-85437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85437 being exploited in the wild.

How severe is CVE-2026-85437?

Critical severity, with a CVSS score of 9.8, published 3 September 2026.

Is there a fix for CVE-2026-85437?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85437 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85437?

Check whether you run MOOS-IvP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85437: MOOS-IvP buffer overflow in function string decoders

CVE-2026-85437 · Severity: critical · CVSS 9.8 · Published 2026-09-03

MOOS-IvP is a set of software modules used to provide autonomous control on robotic platforms, particularly marine vehicles. The system contains multiple buffer overflow vulnerabilities in how it decodes encoded function strings, allowing attackers to craft malicious data that can overflow memory buffers. An attacker can exploit this to achieve remote code execution by injecting malicious MOOS variables or alog files into the system.

Technologies: MOOS-IvP. Vendors: MOOS-IvP.

Quick answers

Is CVE-2026-85437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85437 being exploited in the wild.
How severe is CVE-2026-85437?: Critical severity, with a CVSS score of 9.8, published 3 September 2026.
Which products and versions are affected?: MOOS-IvP through 24.8.1.
Is there a fix for CVE-2026-85437?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85437 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85437?: Check whether you run MOOS-IvP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in IvP function string decoders that fail to properly validate length fields in attacker-controlled encoded strings. The decoders trust declared field lengths without validation, allowing mismatches between declared and actual data lengths. This can result in both heap and stack buffer overflows. The attack vector is network-based, as malicious data can be introduced through MOOS variables or alog files. Remote code execution is achievable without authentication requirements. No patch information is currently available from the advisory text.

Affected products

MOOS-IvP MOOS-IvP through 24.8.1

Timeline

2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.