MOOS core-moos CVE-2026-85455

No special configuration is required beyond MOOSDB being reachable over TCP - exploitation occurs before authentication. The MOOSDB port (default TCP 9000) must be accessible to the attacker; on isolated research or vessel networks this is a local or adjacent-network requirement, while any internet-exposed deployment is directly reachable. No MOOS client authentication, session state, or prior communication is required. The limiting factors are: (1) network reachability to the MOOSDB port, and (2) a MOOS version through 10.4.0 without the PR #75 fix applied.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H) accurately captures the core risk: unauthenticated, low-complexity, network-reachable, with high availability impact and limited confidentiality exposure. The pre-authentication trigger is the primary severity driver - MOOSDB must process the packet before any auth handshake, so there is no credential barrier. Availability impact (process crash or unstable state) is the most reliable outcome; confidentiality impact is bounded to whatever process memory is adjacent to the packet buffer at read time, which is context-dependent and not guaranteed to expose sensitive data. No KEV listing and no standalone POC have been identified, which moderates real-world urgency. EPSS data was not provided, but the attack complexity is minimal once MOOSDB is network-accessible, so opportunistic scanning is plausible if the service is internet-exposed. In typical maritime/robotics deployments MOOSDB runs on isolated research or vessel networks, limiting exposure; however, any internet-facing deployment is at elevated risk. The mismatch between the 'Buffer Overflow' tag in the input and the actual CWE-125 (buffer over-read) is a metadata error and does not affect the impact assessment.

An attacker with network access to the MOOSDB TCP port opens a connection and sends exactly 4 bytes encoding a length value less than 9 - just enough to pass the receive loop but too short to contain a valid message-count field. CMOOSCommPkt::Serialize() reads the 4-byte message count from memory beyond the packet buffer, causing an out-of-bounds read that may crash the MOOSDB process or, depending on memory layout, expose adjacent heap or stack contents. No public exploit code is required; the packet construction is trivial given the detailed fix commit.