CVE-2026-85441

MOOS core-moos through 10.4.0 contains a flaw in CMOOSMsg::operator>> that fails to validate serialized string lengths as non-negative (CWE-195, a signed/unsigned length issue). An unauthenticated attacker with network reachability to the MOOSDB port can send a crafted message carrying a negative length value, triggering an unhandled exception that terminates the MOOSDB database process. Because MOOSDB is the central message broker that all MOOS processes communicate through, killing it disrupts the entire MOOS community on that deployment, though there is no confidentiality or integrity impact. Affected deployments are any running MOOSDB from core-moos versions through 10.4.0, which in practice means robotics research, marine autonomy, and academic/laboratory environments. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS assigns only a 0.4% 30-day exploitation probability, so exploitation has not been observed.

What to do: Inventory deployments running MOOSDB (conventionally on its default MOOSDB TCP port) and upgrade core-moos to a release newer than 10.4.0 once a patched version is published, as the available data does not list a fixed version. Until patching, restrict network access to the MOOSDB port to trusted hosts and processes, and enable process monitoring with automatic restart to blunt any DoS attempt. Avoid exposing MOOSDB to untrusted networks such as the open internet.