MOOS core‑moos in versions up to 10.4.0 contains an off‑by‑one buffer overflow in the GetTelegram() function of the CMOOSSerialPort class. When an attacker sends a full‑length serial telegram, the implementation erroneously writes a NUL terminator one byte beyond the allocated stack buffer, corrupting adjacent stack data. This corruption can pivot into arbitrary code execution if the attacker can influence the overwritten memory, presenting a significant risk to confidentiality, integrity, and availability.

Vendor: the moos project; Product: core‑moos. All releases up to and including version 10.4.0 are affected. Users running any 10.4.0 or earlier release should consider the vulnerability relevant.

The CVSS score of 5.2 denotes a moderate vulnerability, and the EPSS score is not provided. The vulnerability is not listed in CISA’s KEV catalog. The flaw is exploitable when an attacker can control the serial line, implying a local or remotely controllable serial interface. Because the overflow corrupts the stack, an attacker may be able to execute arbitrary code if the fault can be reliably triggered.