The vulnerability in MOOS-IvP allows an attacker to read adjacent memory by exploiting an out‑of‑bounds read in the isQuoted(), isBraced(), and isChevroned() functions. These functions strip whitespace but use the original string length to index the buffer, enabling an over‑read when the input contains leading or trailing spaces. An attacker could gain indirect information about nearby memory contents, potentially exposing sensitive data, corrupting user data, or destabilizing the system. The weakness is identified as CWE‑125, a buffer over‑read condition.

MOOS‑IvP versions up to and including 24.8.1 are affected. These versions process NODE_REPORT messages and contain the vulnerable MBUtils.cpp implementation that performs the insensitive string manipulation.

The CVSS score of 8.7 reflects a high‑severity impact. No EPSS score is available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in KEV. Attackers would need to send a crafted NODE_REPORT message with whitespace padding, which is a low‑effort vector for systems that accept such messages without strict validation. Because the exploit merely causes a read rather than arbitrary code execution, the primary risk is information disclosure and potential corruption of in‑memory data.