CVE-2026-85442

HIGH 7.5

MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

CWE	CWE-789
Vendor	themoos
Product	core-moos
Published	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for themoos core-moos

Be the first to know when new high vulnerabilities affecting themoos core-moos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

themoos / core-moos

0 ≤ 10.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/themoos/core-moos/pull/81 github.com: https://github.com/themoos/core-moos/commit/e7ea624a7b7828b47fcd35fc43feec1f5cfbbe21 github.com: https://github.com/themoos/core-moos github.com: https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/Comms/MOOSCommPkt.cpp#L99 vulncheck.com: https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-moosdb-denial-of-service-via-unbounded-packet-allocation

Credits

Vlatko Kosturjak