Technical impact
MOOS core‑moos versions up to 10.4.0 contain a flaw in CMOOSMsg::operator>> where the length of a serialized string is not validated for non‑negativity. An attacker can send a crafted message with a negative length value to the MOOSDB port; the unvalidated length causes an unhandled exception, terminating the database process. This vulnerability is a CWE‑195 data‑injection issue and results in a denial of service whereby the MOOSDB service stops responding, potentially disrupting autonomous systems relying on that data exchange.
Affected Systems
Software vendor themoos offers its core‑moos package up to version 10.4.0. Users running these releases are affected; the vulnerability description and references target this exact range.
Risk and Exploitability
The CVSS score is 8.7, indicating a high impact. EPSS is not available and the issue is not listed in CISA KEV, so there is no publicly known exploit cataloguing. The likely attack vector is via traversal of the MOOSDB port over an unauthenticated channel; an attacker can send a malformed message without needing privileged credentials or prior access. Once the exception occurs, the database process exits, leading to loss of service until the process is restarted.
