6 matches found
CVE-2026-85438
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
CVE-2026-85438
MOOS-IvP through version 24.8.1 is affected by a buffer overflow vulnerability in StringToIvPFunction() , where dimension, piece, and degree counts from encoded BHV_IPF payloads are used as allocation sizes and loop bounds without validation. An attacker can supply crafted payloads with mismatche...
CVE-2026-85438 MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
CVE-2026-85438 MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
CVE-2026-85438: Integer Overflow or Wraparound
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
PT-2026-85287
Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description A buffer overflow exists in the StringToIvPFunction function. The issue occurs when dimension, piece, and degree counts from encoded BHV IPF payloads are used as allocation sizes and loop bounds...