Executive brief
pMarineViewer is the operator display component of MOOS-IvP, a robotics autonomy software suite used to control autonomous marine vehicles. An attacker can send crafted NODE_REPORT messages with unbounded distinct node identities to exhaust the display's memory and cause it to stall, disrupting operator visualization and vehicle monitoring without requiring authentication.
Technical details
The vulnerability is a resource exhaustion (memory exhaustion) flaw in pMarineViewer's NODE_REPORT message handler. The vulnerable component (ContactLedger) fails to enforce limits on the number of distinct node identities it tracks, allowing an attacker to supply an unbounded number of crafted NODE_REPORT messages with unique node names. Since NODE_REPORT is a MOOS publish/subscribe message accessible over the network without authentication, an attacker can trigger memory allocation for each new node identity until the process runs out of available memory. The result is denial of service to the operator display. Patch availability depends on the MOOS-IvP project's response timeline.
Affected products
- MOOS-IvP pMarineViewer through 24.8.1
Timeline
- 2026-09-03: disclosed