Unbounded Buffer Allocation Vulnerability in MOOS Core-MOOS by MOOS
CVE-2026-85442

8.7HIGH

Key Information:

Vendor

Themoos

Status
Core-moos
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85442?

The MOOS core-moos product up to version 10.4.0 exhibits a vulnerability that fails to validate packet length declarations within the CMOOSCommPkt::OnBytesWritten() function. This flaw allows unauthenticated attackers to send maliciously crafted wire packets with oversized claimed lengths, potentially leading to unbounded memory allocation. Consequently, the server's memory may be exhausted, triggering a denial of service before user authentication is completed. Remediation efforts are underway, indicated by proposed patches and discussions in the development community.

Affected Version(s)

core-moos 0 <= 10.4.0

References

https://github.com/themoos/core-moos/pull/81
issue-trackingpatch
https://github.com/themoos/core-moos/commit/e7ea624a7b782...
patch
https://github.com/themoos/core-moos
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vlatko Kosturjak
.