CVE-2026-85437 MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders

Critical 9.3 Published 3 Sep 2026 Updated 4 Sep 2026

Attackers can achieve remote code execution by sending crafted strings that trigger buffer overflows in IvP function decoders.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-85437?

CVE-2026-85437 is a critical memory corruption vulnerability in moos-ivp, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack buffers, potentially achieving remote code execution through MOOS variables or alog files.

Weakness: CWE-787

Which versions are affected by CVE-2026-85437?

It affects 1 product.

Products include Mit Moos-Ivp.

How do I fix CVE-2026-85437?

No fix has been published for CVE-2026-85437 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-85437 being exploited?

There is no known exploitation of CVE-2026-85437 in the wild and no public exploit code.

Sources

Also known as GHSA-g7c8-266j-mgr2.