Description
MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
Published: 2026-09-03
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow in CMOOSUDPLink::ReadPktFromArray() permits a remote attacker to send a UDP datagram with a negative declared length. The function then performs a memcpy using that length, overwriting memory past the destination buffer. This corruption can corrupt heap data structures and ultimately crash the application, resulting in a denial of service. The flaw is a signed integer overrun (CWE‑191).

Affected Systems

The vulnerability affects the essential‑moos component of the MOOS platform, version 10.0.1, distributed by themoos. Attackers need only send malicious UDP packets to the configured UDPListen port, which is enabled in default installations.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw remotely over the network from any host that can reach the UDP port, making the attack achievable from the internet with minimal reconnaissance.

Generated by OpenCVE AI on September 3, 2026 at 23:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade essential‑moos to a patched release that corrects the length handling in CMOOSUDPLink::ReadPktFromArray().
  • Restrict inbound UDP traffic on the service port to trusted IP ranges or block it entirely with a firewall or nftables rule.
  • If an upgrade is not immediately possible, modify the source to validate that the UDP packet length is non‑negative and does not exceed the receive buffer before copying.

Generated by OpenCVE AI on September 3, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Description MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption and denial of service.
Title MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length
Weaknesses CWE-191
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T22:38:28.519Z

Reserved: 2026-09-03T19:50:56.238Z

Link: CVE-2026-85436

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T23:17:22.937

Modified: 2026-09-03T23:17:22.937

Link: CVE-2026-85436

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T23:30:11Z

Weaknesses
  • CWE-191

    Integer Underflow (Wrap or Wraparound)