A critical (CVSS 9.8) pre-authentication heap overflow in MOOS core-moos through 10.4.0 could allow unauthenticated remote attackers to write out-of-bounds data by declaring a negative packet length.
What Is It
CVE-2026-85440 is an out-of-bounds write (CWE-787) in the MOOSCommPkt packet handling path of MOOS core-moos. According to the advisory, a remote attacker who declares a negative packet length in a crafted packet can defeat the signed integer check in InflateTo(), producing a negative size conversion in recv(). The reported result is an overflow of a four-byte heap buffer, which occurs during the HandShake phase; before any authentication takes place.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). It was disclosed by VulnCheck.
Why It Matters
The scoring metrics indicate few of the barriers that normally slow an attacker. The vector is network-reachable, attack complexity is rated low, no privileges are required, and no user interaction is needed. Because the overflow is reported to trigger during the handshake, authentication would not be expected to mitigate it; any host able to reach the listening MOOSDB service is potentially in scope. Confidentiality, integrity, and availability impacts are all rated HIGH, indicating that successful exploitation could compromise the full scope of the affected process. The supplied data does not include a public exploit or a demonstrated path from the overflow to code execution, so the practical difficulty of weaponizing the write is not established.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation at this time and no KEV-mandated remediation deadline.
What's Vulnerable
- Vendor: themoos
- Product: core-moos
- Affected versions: all versions up to and including 10.4.0 (
<= 10.4.0); all other versions listed as unaffected
The vulnerable code path is in Core/libMOOS/Comms/MOOSCommPkt.cpp.
Patch Status
The NVD record references an upstream commit (96c49c5cdda6e07ee734a5324e8d25ba5a7f2d7a) and pull request #82 in the themoos/core-moos repository. Operators running core-moos 10.4.0 or earlier should track those upstream changes and update accordingly. No vendor-published fixed release version is stated in the supplied data, and no required-action deadline applies absent a KEV listing.