CVE-2026-85452: MOOS ui-moos through 50b9c6c uMS Buffer Overflow via Long MOOS Identifiers
MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MOOS ui-moosto a version that resolves this vulnerability.Fixed in 50b9c6c - Configuration
Modify ScopeTabPane.cpp and ScopeGrid.cpp to prevent buffer overflow by eliminating sprintf writes into fixed 1024-byte buffers for client and variable names, ensuring length validation/truncation before formatting.
MOOS ui-moos (ScopeTabPane.cpp, ScopeGrid.cpp) Replace sprintf into fixed 1024-byte buffers with length-validated formatting = use safe, length-checked formatting instead of sprintf without length validation
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Operators using the affected ui-moos interface are exposed when they select process list entries or poke variables associated with attacker-controlled long MOOS client or variable identifiers.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply arbitrarily long MOOS identifiers and induce an operator to select the relevant process list entry or poke the affected variable. No attacker privileges are indicated by the provided vector, but user interaction is required.
What can be done if patching is not immediately possible?
Limit untrusted parties' ability to introduce or control MOOS client and variable identifiers, and avoid selecting process entries or poking variables with unusually long names in ui-moos.