MOOS core‑moos versions up to 10.4.0 allow an attacker to send packets whose declared lengths are not validated. When the server reads a packet with a very large length, it dynamically allocates a buffer of that size before client authentication has even completed, leading to excessive memory consumption. An attacker who can write arbitrary packets to the MOOSDB port can therefore trigger an unbounded allocation that exhausts available system memory and brings the service to a halt, compromising availability without affecting confidentiality or integrity.

The vulnerable component is found in the MOOS core‑moos project by themoos. All releases through 10.4.0 are affected; later releases are not known to carry this flaw. The vulnerability is present in the CMOOSCommPkt::OnBytesWritten() routine that processes inbound wire packets.

With a CVSS score of 8.7 the flaw is considered high. No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog. Attackers likely exploit the flaw from a network surrounding the MOOSDB instance; authentication is not required. Because the buffer grows unbounded, a single crafted packet can exhaust memory, making this a straightforward denial‑of‑service attack when the MOOSDB server is reachable from the outside.