Description
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
Published: 2026-09-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

The flaw is a use‑after‑free in MoQSession::dataStreamReadLoop. When a remote peer sends a data stream that references an unknown track alias and includes a FIN flag, the implementation continues to reference the stream read handle after the FIN has been processed, causing the handle to become stale. This stale use can destabilize the service, resulting in a crash.

Affected Systems

All releases of Meta Platforms, Inc.’s moxygen that precede commit 004123dd24c3 are affected. No specific product version numbers are listed, so any deployment that has not applied this commit is potentially exposed.

Risk and Exploitability

The vulnerability can be exploited remotely over the network via WebTransport connections. An attacker with network access to a moxygen instance could craft a malicious data stream as described to trigger the defect. The EPSS score is below 1% and the issue is not listed in CISA’s KEV catalog; the use‑after‑free nature provides a high‑impact exploit surface. The CVSS score of 7.5 indicates high severity. If successfully exploited, the defect could cause service disruption by crashing the moxygen service.

Generated by OpenCVE AI on October 1, 2026 at 04:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch that includes commit 004123dd24c3 or later to all affected moxygen installations.
  • If an update cannot be performed immediately, disable or block WebTransport data stream handling for unknown track aliases using firewall or application‑level controls.
  • Monitor moxygen for abnormal restarts or crash logs and configure alerts to detect potential exploitation attempts.

Generated by OpenCVE AI on October 1, 2026 at 04:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in moxygen Data Stream Read Loop Causes Service Crash

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Tue, 29 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Meta Platforms Inc
Meta Platforms Inc moxygen
Vendors & Products Meta Platforms Inc
Meta Platforms Inc moxygen

Mon, 28 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
References

Subscriptions

Meta Platforms Inc Moxygen
cve-icon MITRE

Status: PUBLISHED

Assigner: Meta

Published:

Updated: 2026-09-30T15:05:50.817Z

Reserved: 2026-09-02T14:52:36.354Z

Link: CVE-2026-84894

cve-icon Vulnrichment

Updated: 2026-09-30T15:03:42.745Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T19:16:50.213

Modified: 2026-09-30T19:57:08.043

Link: CVE-2026-84894

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T04:15:16Z

Weaknesses