MOOS-IvP StringToIvPFunction() Buffer Overflow

Technical Analysis

CVE-2026-85438 (CVSS 9.8) arises in StringToIvPFunction() where dimension, piece, and degree counts parsed from encoded BHV_IPF payloads are used directly as allocation sizes and loop bounds without validation. An attacker can supply a payload with a mismatched dimension count relative to the actual data size, causing the parser to write attacker-controlled double-precision floating point values past the end of the allocated IvPBox weight array. This heap-based buffer overflow can corrupt adjacent memory structures, function pointers, or control data, enabling memory corruption and potential arbitrary code execution on hosts running the MOOS-IvP autonomy stack. Exploitation requires the ability to inject or influence BHV_IPF-encoded messages into the MOOSDB or behavior pipeline, such as through a compromised sensor feed, spoofed inter-vehicle communication, or malicious mission file. While MOOS-IvP is primarily used in unmanned marine vehicle (UMV) autonomy rather than conventional LLM/agent frameworks, any AI agent system that ingests IvP-encoded data as a tool input or bridges to MOOS-IvP for robotic decision-making inherits this deserialization-style risk, underscoring the broader lesson that unvalidated size fields in structured payloads consumed by agent tool-calling pipelines remain a systemic RCE vector.

Affected Systems

MOOS-IvP through version 24.8.1, including all deployments using the StringToIvPFunction() parser for BHV_IPF-encoded messages; unmanned marine/surface/underwater vehicle autonomy stacks; any custom applications or bridges that parse IvP function strings using the vulnerable library code

Indicators of Compromise

• No specific IOCs published; vulnerability is in open-source parsing code (StringToIvPFunction) rather than tied to observed campaign artifacts. Organizations should monitor for anomalous BHV_IPF payload sizes and malformed dimension/piece/degree fields in MOOSDB traffic.

Remediation Steps

1. 1

   Patch MOOS-IvP

   Upgrade to a patched version of MOOS-IvP once released by maintainers; monitor the official MOOS-IvP GitHub repository and NVD for fix availability.

2. 2

   Input validation at parser boundary

   Add strict bounds checking on dimension, piece, and degree fields in StringToIvPFunction() before using them as allocation sizes or loop bounds; reject payloads with inconsistent or oversized values.

3. 3

   Network/message source restriction

   Restrict which hosts, sensors, or vehicles can inject BHV_IPF-encoded messages into the MOOSDB; use authentication and message integrity checks on inter-process and inter-vehicle communications.

4. 4

   Memory protection hardening

   Compile MOOS-IvP binaries with stack canaries, ASLR, DEP/NX, and fortified source functions to reduce exploitability of the overflow.

5. 5

   Runtime monitoring

   Deploy fuzzing and runtime sanitizers (ASan) in test environments to catch malformed IvP function payloads, and add logging/alerting for parser exceptions or crashes in production.