CVE-2026-85455: MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet
MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running MOOS core-moos through version 10.4.0 are exposed if an attacker can reach the MOOSDB TCP port. The attack occurs before authentication, so unauthenticated network access to that port is the relevant exposure condition.
What does an attacker need to exploit it?
An attacker only needs to establish a TCP connection to the MOOSDB port and send a crafted four-byte packet. No credentials or user interaction are required.
What is the impact of successful exploitation?
The crafted short packet causes an out-of-bounds memory read during packet deserialization. This can allow an attacker to read memory, and the reported severity vector also indicates a high availability impact.
What can be done while patching is not immediately possible?
Restrict network access to the MOOSDB port so untrusted hosts cannot open TCP connections to it. Because exploitation is pre-authentication, relying on authentication alone does not mitigate the issue.