Buffer Overflow Vulnerability in MOOS Essential-MOOS Software by The MOOS Vendor
CVE-2026-85436

8.7HIGH

Key Information:

Vendor

Themoos

Status
Essential-moos
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85436?

The MOOS essential-moos software up to version 10.0.1 is prone to a buffer overflow vulnerability in the CMOOSUDPLink::ReadPktFromArray() method. This flaw enables remote attackers to manipulate heap memory by sending specially crafted UDP datagrams with negative declared lengths to the UDPListen port. This manipulation can lead to an oversized memcpy operation that exceeds the bounds of the destination buffer, resulting in heap corruption and potential denial of service.

Affected Version(s)

essential-moos 0 <= 10.0.1

References

https://github.com/themoos/essential-moos/pull/21
issue-trackingpatch
https://github.com/themoos/essential-moos/commit/613175fc...
patch
https://github.com/themoos/essential-moos
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vlatko Kosturjak
.