What’s Vulnerable › Vulnerabilities

CVE-2026-85436: MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-10-14
• Weakness: CWE-191

Description

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.

Affected products

• themoos essential-moos: before 10.0.1 — fixed in 10.0.1

How to fix

Upgrade to a fixed version: themoos essential-moos 10.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/themoos/essential-moos
• https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pMOOSBridge/MOOSUDPLink.cpp#L171
• https://github.com/themoos/essential-moos/commit/613175fcf63fb9c6c5329c4ec57c2d18588b33e2
• https://github.com/themoos/essential-moos/pull/21
• https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pmoosbridge-heap-corruption-via-negative-udp-length

Get alerted when CVE-2026-85436 or the next vulnerability affects your stack