CVE-2026-85436

MOOS essential-moos through version 10.0.1 contains a buffer overflow in CMOOSUDPLink::ReadPktFromArray(), where UDP datagrams carrying negative declared lengths (CWE-191, integer underflow) cause an oversized memcpy that writes past the destination buffer. An unauthenticated remote attacker who can reach the configured UDPListen port can send crafted UDP packets to trigger heap memory corruption. The primary impact is denial of service through heap corruption; the CVSS 4.0 score of 8.7 (high) reflects high availability impact with no confidentiality or integrity impact scored. Any deployment of essential-moos version 10.0.1 or earlier that listens on a UDP port is affected. There is currently no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 1.2% probability of exploitation in the next 30 days.

What to do: Inventory deployments running essential-moos 10.0.1 or earlier with UDP communications enabled, and restrict access to the configured UDPListen port to trusted hosts via firewall rules or network ACLs as an interim mitigation. Monitor the MOOS project for a patched release beyond 10.0.1 and upgrade when available; no fixed version is specified in current disclosure data.