MOOS core‑moos versions up to 10.4.0 contain a pre‑authentication heap overflow in the MOOSCommPkt packet handling routine. By sending a packet with a negative length, an attacker can overflow a four‑byte heap buffer during the HandShake phase before authentication. This overflow allows the attacker to write arbitrary data into memory, which can lead to remote code execution or the execution of malicious commands on the vulnerable system.

The vulnerability affects installations of themoos: core‑moos through version 10.4.0. Any machine running this software exposed to a network that can send packet data to the MOOS database is potentially impacted.

With a CVSS score of 9.3 the vulnerability is classified as critical; the EPSS score is not available, so the exact exploitation likelihood is unknown, but the lack of a KEV listing suggests no widespread active exploitation has been observed yet. The vulnerability can be triggered remotely by an attacker who can reach the MOOS database before authentication is completed, making the attack surface dependent on network exposure. Exploit code would need to construct a packet with a negative length and send it during the handshake phase, taking advantage of the signed integer check in InflateTo() and the negative size conversion in recv().