essential-moos CVE-2026-85436

The pMOOSBridge process must be running with a UDPListen port configured and the socket bound. The attacker requires only UDP network reachability to that port - the UDP listener imposes no authentication challenge. Exploitation applies to versions through 10.0.1; builds incorporating commit 613175fcf63fb9c6c5329c4ec57c2d18588b33e2 reject negative nRqd values before the memcpy is reached. No user interaction is required and no special operating-system configuration or elevated local access is necessary. Impact is strictly availability - heap corruption crashes the pMOOSBridge process; arbitrary code execution has not been demonstrated, and the supplied CVSS records VC:N and VI:N confirming no confidentiality or integrity compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, score 8.7) correctly characterises the exploit conditions: network-reachable, zero prerequisites, a single UDP datagram, resulting in a process crash through heap corruption. Because pMOOSBridge's UDPListen port must be reachable by peer MOOS communities for normal operation, network-level mitigation options are constrained - even a mid-sized maritime research operator in olsztyn would need to expose the port to inter-community traffic, limiting firewall isolation as a compensating control. No active exploitation has been confirmed (no CISA KEV entry) and no public proof-of-concept code has been identified at time of analysis, which tempers urgency despite the high base score. EPSS data is absent from the supplied intelligence; exploitation probability is inferred as low-to-moderate given the niche deployment footprint, but the attack complexity is genuinely low once port access is established. Critically, the CVSS records no confidentiality or integrity impact (VC:N/VI:N): this is a denial-of-service through heap corruption, not a full compromise. In conventional IT contexts that would reduce priority, but in autonomous maritime or robotic platforms the availability impact of crashing the MOOS bridge can have physical safety implications beyond a standard service outage.

An attacker with UDP reachability to the pMOOSBridge listen port sends a single crafted datagram in which the embedded packet-length field encodes a value smaller than the fixed MOOS packet header size, causing nRqd to compute as a negative integer. The negative nRqd passes the signed bounds check unimpeded, is then cast to a near-SIZE_MAX size_t value when memcpy is called, and the resulting multi-gigabyte write immediately corrupts heap metadata, crashing the pMOOSBridge process. No public exploit code has been identified at time of analysis, but the technique requires only basic knowledge of the MOOS UDP wire format and a small crafted payload.