CVE-2026-85429

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.

MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can declare arbitrarily large packet counts to trigger unbounded memory allocation, exhausting system resources and causing service unavailability.

MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory.

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.

Buffer overflow vulnerability in MOOS-IvP through 24.8.1 in StringToIvPFunction(), where dimension, piece, and degree counts from encoded BHV_IPF payloads are used without validation. Attackers can supply crafted payloads to write past the IvPBox weight array.

Multiple buffer overflow vulnerabilities in MOOS-IvP through 24.8.1 in IvP function string decoders that trust attacker-controlled length fields. Crafted encoded strings can overflow heap and stack buffers, potentially enabling remote code execution.