CVE-2026-85436: MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MOOS essential-moosto a version that resolves this vulnerability.Fixed in 10.0.1Patch MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length - Compensating control
Mitigate exploitation by restricting network access to the configured MOOS UDPListen port (e.g., block/limit UDP traffic to that port at the firewall/ACL to trusted sources only).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of MOOS essential-moos through 10.0.1 that use pMOOSBridge and have a configured UDPListen port are exposed to crafted UDP datagrams sent to that port.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What is the immediate impact of a successful attack?
A crafted UDP packet with a negative declared length can cause an oversized memcpy operation, corrupting heap memory and causing denial of service.
What can be done if an update cannot be applied immediately?
Restrict access to the configured UDPListen port so that untrusted hosts cannot send UDP datagrams to it.