Mit Moos-Ivp vulnerabilities

14 CVEs affecting Mit Moos-Ivp, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85456, published 2026-09-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-85425, published 2026-09-03. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages…
CVE-2026-85437, published 2026-09-03. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft…
CVE-2026-85438, published 2026-09-03. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction() where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop…
CVE-2026-85449, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names.…
CVE-2026-85448, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel vectors within ShoreBroker::handleMailNodePing(). A single publisher can supply unbounded…
CVE-2026-85447, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating duration or variable list limits. Attackers can register long-lived pipeways with many…
CVE-2026-85446, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new node identity creates a ledger entry and triggers all-pairs distribution work. Attackers…
CVE-2026-85445, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function that trusts the packet count declared in mux headers without validation. Attackers can…
CVE-2026-85444, published 2026-09-03. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers…
CVE-2026-85439, published 2026-09-03. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file…

Latest

CVE-2026-85456, published 2026-09-03. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply…