EUVD-2026-70786
GHSA-44c2-mhg8-554v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker injects oversized identifier into MOOSDB without credentials (AV:N, AC:L, PR:N); operator must interact with uMS UI to trigger overflow (UI:R); code execution on operator workstation with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names are formatted into fixed 1024-byte buffers using sprintf without length validation. Attackers can supply arbitrarily long MOOS identifiers that overflow the buffers when an operator selects process list entries or pokes variables, enabling code execution.
AnalysisAI
Stack buffer overflow in the uMS graphical operator tool of MOOS ui-moos through commit 50b9c6c allows an unauthenticated network attacker to achieve code execution on an operator workstation by injecting excessively long client or variable names into the MOOSDB pub-sub middleware. When the operator subsequently selects a malicious process list entry or pokes an oversized variable through the uMS interface, unchecked sprintf calls in ScopeTabPane.cpp and ScopeGrid.cpp overflow fixed 1024-byte stack buffers, enabling memory corruption and control-flow hijack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be satisfied. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) is broadly credible for the attack scenario described: an unauthenticated network peer preloads the MOOSDB with an oversized identifier, then waits for a legitimate operator interaction to trigger the overflow passively (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream patch from PR #5 (commit a6ebc0bc6cb360315ce620e865f996d189cddb0e) available at https://github.com/themoos/ui-moos/pull/5, which replaces all three unchecked sprintf calls with snprintf bounded by sizeof(buffer) in both ScopeTabPane.cpp and ScopeGrid.cpp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all workstations running MOOS ui-moos and, where operationally feasible, disable or isolate access to MOOSDB pub-sub middleware; notify operators of the vulnerability and restrict tool use to verified safe network segments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today