PatchTheCVECVE-2026-85456: MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandle
CVE-2026-85456 is a medium-severity flaw (CVSS 5.5) affecting moos-ivp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 86%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-09-03 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-85456?
moos-ivp: upgrade to 24.8.1. Exact commands for each OS are on this page.
Is CVE-2026-85456 being exploited?
CVE-2026-85456 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-85456 affect?
CVE-2026-85456 affects moos-ivp. Severity is medium (CVSS 5.5). MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences
How urgent is CVE-2026-85456?
Priority 23/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-85449 HIGH 7.5 UPGRADE MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODE_REPORT me
- CVE-2026-85448 HIGH 7.5 UPGRADE MOOS-IvP uFldShoreBroker through 24.8.1 fails to limit the number of claimed communities stored in parallel ve
- CVE-2026-85447 HIGH 7.5 UPGRADE MOOS-IvP pRealm through version 24.8.1 accepts unbounded REALMCAST_REQ subscriptions without validating durati
- CVE-2026-85446 HIGH 7.5 UPGRADE MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms where each new
- CVE-2026-85445 HIGH 7.5 UPGRADE MOOS-IvP through 24.8.1 contains a denial of service vulnerability in the Demuxer::addMuxPacket() function tha