Is CVE-2026-85449 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85449 being exploited in the wild.

How severe is CVE-2026-85449?

High severity, with a CVSS score of 7.5, published 3 September 2026.

Which products and versions are affected?

MOOS-IvP pMarineViewer through 24.8.1.

Is there a fix for CVE-2026-85449?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85449 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85449?

Check whether you run MOOS-IvP pMarineViewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85449: MOOS-IvP pMarineViewer memory exhaustion via NODE_REPORT messages

CVE-2026-85449 · Severity: high · CVSS 7.5 · Published 2026-09-03

pMarineViewer is the operator display component of MOOS-IvP, a robotics autonomy software suite used to control autonomous marine vehicles. An attacker can send crafted NODE_REPORT messages with unbounded distinct node identities to exhaust the display's memory and cause it to stall, disrupting operator visualization and vehicle monitoring without requiring authentication.

Vendors: MOOS-IvP.

Quick answers

Is CVE-2026-85449 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85449 being exploited in the wild.
How severe is CVE-2026-85449?: High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?: MOOS-IvP pMarineViewer through 24.8.1.
Is there a fix for CVE-2026-85449?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85449 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85449?: Check whether you run MOOS-IvP pMarineViewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a resource exhaustion (memory exhaustion) flaw in pMarineViewer's NODE_REPORT message handler. The vulnerable component (ContactLedger) fails to enforce limits on the number of distinct node identities it tracks, allowing an attacker to supply an unbounded number of crafted NODE_REPORT messages with unique node names. Since NODE_REPORT is a MOOS publish/subscribe message accessible over the network without authentication, an attacker can trigger memory allocation for each new node identity until the process runs out of available memory. The result is denial of service to the operator display. Patch availability depends on the MOOS-IvP project's response timeline.

Affected products

MOOS-IvP pMarineViewer through 24.8.1

Timeline

2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.