MOOS core-moos CVE-2026-85441

MOOSDB must be running and its TCP port must be reachable by the attacker. No authentication, prior session establishment, or special privilege is required - within a default MOOS deployment, all network peers able to connect to MOOSDB qualify as potential attackers. The PR:N/AC:L CVSS metrics confirm this. Exploitation is limited exclusively to denial-of-service via process crash; code execution and data exfiltration are not achievable through this vector. The vulnerability does not affect deployments in which MOOSDB is isolated behind a host or network firewall blocking untrusted connections to the MOOSDB TCP port.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) yields a score of 8.7, indicating a high-severity, network-reachable, zero-prerequisite denial-of-service with no ambiguity in metric choice - the attack requires a single crafted packet with no authentication, complexity, or user interaction. The impact is purely on availability (VA:H); confidentiality and integrity are confirmed unaffected. No EPSS data was supplied and the vulnerability is not listed in the CISA KEV catalog, so active exploitation in the wild is not confirmed. The attack is trivially automatable and the behavioral description in the VulnCheck advisory is sufficient to construct a proof-of-concept, but real-world risk is bounded by MOOS's narrow deployment footprint in academic, research, and specialized robotics contexts. MOOSDB is rarely internet-exposed; however, within a research network or autonomous vehicle testbed, any network peer - including untrusted MOOS clients - can crash the entire publish-subscribe backbone with a single message.

An attacker with network access to the MOOSDB TCP port sends a single crafted MOOS protocol message in which the string-length field of a serialized CMOOSMsg is set to a negative integer. The server's deserialization routine reads the negative value, which passes the existing arithmetic threshold, then forwards it to a string operation where it is widened to a near-maximal size_t, triggering a std::exception that propagates uncaught through the accept loop and terminates the MOOSDB process, halting all MOOS-based inter-process communication across the entire system.