CVE-2026-85449

High

Description

MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.

SeverityHigh

CVSS7.5

Exploit probability—

ProductMit Moos-ivp

PublishedSep 3, 2026

First seenSep 3, 2026

Weakness typeCWE-770Allocation of resources without limits

How to fix

Update

mit moos-ivp24.8.1 or later

Patches

github.com/moos-ivp/moos-ivp/pull/134
github.com/moos-ivp/moos-ivp/commit/4d8d0693d3f8bf8907dc0aed04ea488d85af9f22

Affected products

Product	Affected versions	Fixed in
mit moos-ivp	v < 24.8.1	24.8.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.