The flaw in MOOS-IvP versions up to 24.8.1, located in StringToIvPFunction(), allows an attacker to supply crafted IvP payloads with mismatched dimension, piece, and degree counts. These counts are used without validation as allocation sizes and loop bounds, causing an out‑of‑bounds write into the IvPBox weight array. The memory corruption can be leveraged to execute arbitrary code, giving attackers control over the process that runs MOOS‑IvP. This is a classic unvalidated input resulting in integer or buffer overflow (CWE‑190).

MOOS‑IvP released by the MOOS‑IvP community, specifically versions 24.8.1 and earlier. The vulnerable components are the StringToIvPFunction and related library functions that build IvP functions from encoded payloads.

The vulnerability has a CVSS score of 9.3, indicating critical severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. Attackers can remotely trigger the flaw by sending malformed payloads over any network path that reaches the MOOS‑IvP process, such as the standard MOOS network or a privileged client. Once exploited, the attacker achieves code execution with the privileges of the MOOS‑IvP service, potentially compromising the entire host system.