CVE-2026-85440

MOOS core-moos through 10.4.0 contains a pre-authentication heap-based out-of-bounds write (CWE-787) in the MOOSCommPkt packet-handling code. A remote attacker triggers it during the initial HandShake phase, before any authentication, by declaring a negative packet length: the value passes the signed integer check in InflateTo() and is converted to a large size in recv(), causing a four-byte heap buffer to be overflowed with attacker-controlled data. The 9.3 critical CVSS 4.0 score with high confidentiality, integrity, and availability impact indicates the write can meaningfully compromise the process, though no public proof-of-concept or confirmed remote code execution is documented. Anyone running a MOOS core-moos process at version 10.4.0 or earlier that accepts network connections from untrusted peers is affected, which in practice means robotics and marine-autonomy deployments and research networks. No exploitation in the wild is known: the flaw is not in CISA KEV, no PoC is public, and EPSS estimates only a 0.6% chance of exploitation in the next 30 days.

What to do: Inventory systems running MOOS core-moos and upgrade to a fixed release above 10.4.0 as soon as the upstream project publishes one, since no fixed version is stated in this advisory. Until patching, firewall or otherwise restrict the MOOSDB/IPC network listener to trusted hosts, because exploitation requires only network reachability during the pre-authentication handshake. Given the critical score, monitor the upstream repository and this advisory for a public PoC or in-the-wild reports.