A buffer overflow vulnerability in the MOOS-IvP library allows unauthenticated remote attackers to achieve arbitrary code execution via crafted BHV_IPF payloads.

The application fails to perform bounds checking on dimension, piece, and degree counts when processing encoded BHV_IPF payloads. This allows an unauthenticated attacker to supply malformed input that triggers an out of bounds write, leading to memory corruption and potential code execution.

Successful exploitation of this vulnerability poses a critical risk to organizational infrastructure, as it allows for unauthorized remote code execution on systems running the affected software. This could result in a complete system compromise, unauthorized access to sensitive data, or severe operational disruption. Given the CVSS score of 9.8, the vulnerability is classified as critical, requiring immediate attention to prevent potential exploitation.

Immediate Action: Update the MOOS-IvP installation to the latest version, which contains the necessary bounds checking logic to prevent the buffer overflow.

Proactive Monitoring: Monitor system logs for unusual process crashes or unexpected service restarts, which may indicate attempted exploitation of memory corruption vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall or intrusion detection system to inspect incoming traffic for malformed BHV_IPF payloads that exhibit mismatched dimension or count values.

Public Exploit Available: No (exploit_available unknown).

Due to the critical severity and the potential for remote code execution, organizations must prioritize patching this vulnerability immediately. Ensure all instances of MOOS-IvP are updated to the latest available version to eliminate the underlying memory safety flaw. If an immediate update is not feasible, restrict network access to the affected service to trusted segments to reduce the attack surface.