CVE-2026-85442

CVE-2026-85442 is an unauthenticated denial-of-service flaw in MOOS core-moos through version 10.4.0, caused by failure to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(). An attacker can send crafted wire packets declaring large lengths to the MOOS server, triggering unbounded buffer allocation and exhausting server memory. Successful attacks result in denial of service against the affected process (e.g., the MOOSDB communications server), with no confidentiality or integrity impact. Any deployment running core-moos 10.4.0 or earlier is affected, and the flaw is reachable pre-authentication, so even clients that have not logged in can trigger it. There is currently no known public proof-of-concept, no listing in CISA KEV, and a low (0.4%) 30-day exploitation probability per EPSS.

What to do: Upgrade to a fixed core-moos release as soon as the vendor publishes one (no fixed version is specified in the available data; monitor the MOOS project's advisories). Until then, restrict network access to MOOSDB and related MOOS communication ports to trusted hosts and networks via firewall rules, since the flaw is exploitable before authentication. Monitor server memory usage for abnormal growth from unauthenticated connections.