CVE-2026-85438
Critical
Description
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to write attacker-controlled doubles past the end of the IvPBox weight array, causing memory corruption and potential code execution.
SeverityCritical
CVSS9.8
Exploit probability65. percentile1.1%
ProductMit Moos-ivp
PublishedSep 3, 2026
First seenSep 3, 2026
Weakness typeCWE-190Integer overflow
How to fix
Update
- mit moos-ivp24.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit moos-ivp | v < 24.8.1 | 24.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.