Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

MOOS‑IvP pMarineViewer may exhaust memory via fake reports

CVE-2026-85449 · published 2 months ago
Summary

The pMarineViewer component of MOOS‑IvP (versions up to 24.8.1) does not limit how many different node names it tracks from incoming NODE_REPORT messages. An attacker who can send specially crafted reports can cause the display program to use all available memory, making it slow or crash. Apply the vendor’s update or restrict who can send NODE_REPORT data to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
moos-ivp moos-ivp <= 24.8.1
Original advisory text
MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORT
MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODE_REPORT data to cause memory exhaustion and stall the operator display without authentication.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published3 Sep 2026
Updated3 Nov 2026
First seen3 Sep 2026
Sources
CVE-2026-85449 · NVD
CVE-2026-85449 · MITRE
CVE-2026-85449 · OSV
Track software like this
Free during beta