CVE-2026-85452

MOOS ui-moos, the graphical scope/monitoring client for the MOOS robotics middleware, contains a buffer overflow (CWE-787, out-of-bounds write) in ScopeTabPane.cpp and ScopeGrid.cpp, where client and variable names are copied into fixed 1024-byte buffers with sprintf and no length validation. A remote MOOS peer that publishes a process or variable identifier longer than 1024 bytes triggers the overflow when an operator selects an entry in the process list or pokes that variable, so network reachability combined with user interaction (CVSS 4.0 UI:P) is required for exploitation. A successful overflow allows arbitrary code execution in the context of the ui-moos process on the operator's workstation. Anyone running ui-moos up to and including commit 50b9c6c is affected, primarily marine-robotics, autonomy, and academic research deployments that use MOOS middleware. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.4%, so exploitation has not been observed.

What to do: Update ui-moos to a build newer than commit 50b9c6c, or apply a patch that length-checks identifiers before the sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp. Restrict network access so only trusted hosts can act as MOOS clients/peers connected to scope instances, since untrusted peers publishing oversized names are the attack source. Note that exploitation requires an operator to select process-list entries or poke variables, so warn operators about connecting scope clients to untrusted MOOS communities; no in-the-wild exploitation is currently known.