P4Verified

CVE-2026-85456: moos-ivp before 24.8.1 (exclusive), 0 through 24.8.1

CVE-2026-85456. CVSS 3.1 base score 5.5 (MEDIUM, Vendor/CNA). EPSS 0.00184 (percentile 0.07419), scored 13-Oct-2026.

Affected technology

moos-ivp · before 24.8.1 (exclusive)
mit

moos-ivp · 0 through 24.8.1
moos-ivp

Description’s affected range: through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · Passive user interaction

What an attacker can do

Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems. Vendor/CNA’s CVSS 4.0 assessment (base score 6.8/10) rates confidentiality and availability impact as none; integrity impact as high.

Published 15-Oct-2026 01:10 UTC

CWE: CWE-22
CCR priority: 22.0 /100 (P4)
CVSS 3.1: 5.5 /10 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · Vendor/CNA
EPSS: 0.00184 · percentile 0.07419 · 2026-10-13
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-85456.html