What’s Vulnerable › Vulnerabilities

CVE-2026-85442: MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-03 · updated 2026-10-14
• Weakness: CWE-789

Description

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

Affected products

• themoos core-moos: before 10.4.0 — fixed in 10.4.0

How to fix

Upgrade to a fixed version: themoos core-moos 10.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/themoos/core-moos
• https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSCommPkt.cpp#L99
• https://github.com/themoos/core-moos/commit/e7ea624a7b7828b47fcd35fc43feec1f5cfbbe21
• https://github.com/themoos/core-moos/pull/81
• https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-denial-of-service-via-unbounded-packet-allocation

Get alerted when CVE-2026-85442 or the next vulnerability affects your stack