CVE-2026-85454: MOOS core-moos through 10.4.0 Off-by-One Buffer Overflow in Serial Telegram Handling
MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL terminator one byte past the serial telegram stack buffer. Attackers controlling the serial line can send a full-length telegram to trigger the off-by-one write, corrupting the stack and potentially enabling code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using core-moos through 10.4.0 that accept telegrams from an attacker-controlled serial line are exposed. The issue is in CMOOSSerialPort::GetTelegram().
What does an attacker need to exploit it?
An attacker needs control of the serial line and must send a telegram that reaches the full buffer length. No privileges or user interaction are required according to the provided vector.
What is the likely impact of successful exploitation?
The full-length telegram causes a NUL terminator to be written one byte beyond the stack buffer, corrupting stack memory. This can affect integrity and availability and may potentially enable code execution.