CVE-2026-85442

Received Received - Intake

Memory Exhaustion in MOOS Core-MOOS via Unbounded Packet Length

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85442

Affected Vendors & Products

Vendor	Product	Version / Range
moos	core-moos	to 10.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(). This allows unauthenticated attackers to send crafted wire packets with large declared lengths, triggering unbounded buffer allocation. The server allocates excessive memory, exhausting resources and causing denial of service before client authentication completes.

Detection Guidance

Monitor for unusually large memory allocations or crashes in MOOS core-moos processes. Check network traffic for packets with abnormally large declared lengths before authentication. Use packet capture tools like tcpdump or Wireshark to inspect CMOOSCommPkt packets for invalid length declarations.

Impact Analysis

This vulnerability can lead to denial of service by crashing or severely degrading the performance of servers running MOOS core-moos. Since it occurs before authentication, attackers can exploit it remotely without needing valid credentials, potentially disrupting services that rely on this software.

Compliance Impact

This vulnerability causes denial of service by exhausting server memory, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the availability of protected health information systems. However, the provided CVE data does not specify direct compliance impacts.

Mitigation Strategies

Update MOOS core-moos to a patched version if available. Implement network-level filtering to block packets with excessively large declared lengths before they reach the server. Restrict unauthenticated access to CMOOSCommPkt endpoints until a fix is applied.

Hi! I’m here to help you understand CVE-2026-85442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70