Untrusted Pointer Dereference in Mooncake Transfer Engine
CVE-2026-103764

9.3CRITICAL

Key Information:

Vendor

Kvcache-ai

Status
Mooncake
Vendor
CVE Published:
1 October 2026

What is CVE-2026-103764?

The Mooncake Transfer Engine, prior to version 0.3.13, is susceptible to an untrusted pointer dereference due to improper handling of SessionHeader in the ServerSession::readHeader method. This vulnerability enables unauthenticated attackers to manipulate memory addresses and sizes, facilitating unauthorized read and write operations on arbitrary process memory via the TCP transport data port. By exploiting this flaw, attackers can potentially disclose sensitive data, including KV cache contents and secret prompts, or corrupt memory which can lead to code execution.

Affected Version(s)

Mooncake 0 < 0.3.13

References

https://github.com/kvcache-ai/Mooncake/issues/4441
issue-tracking
https://github.com/kvcache-ai/Mooncake/commit/a2933849417...
patch
https://github.com/kvcache-ai/Mooncake/releases/tag/v0.3.13
release-notes

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mingkai Yu
Jiajia Liu
.