CVE-2026-85445 MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count
Attackers can cause denial of service in MOOS-IvP by sending mux packets with large declared counts, triggering unbounded memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85445?
CVE-2026-85445 is a high-severity denial of service vulnerability in moos-ivp, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.
Weakness: CWE-789
Which versions are affected by CVE-2026-85445?
It affects 1 product.
Products include Mit Moos-Ivp.
How do I fix CVE-2026-85445?
No fix has been published for CVE-2026-85445 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-85445 being exploited?
There is no known exploitation of CVE-2026-85445 in the wild and no public exploit code.
Other vulnerabilities in moos-ivp
- CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
- CVE-2026-85434 MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping
- CVE-2026-85435 MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment
- CVE-2026-85437 MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
- CVE-2026-85438 MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
Sources
Also known as GHSA-8cvc-f53x-r3v4.