MOOS core-moos EUVD-2026-70788

Exploitation requires physical control of the serial communication line directly connected to the MOOS-enabled system. The attacker must be able to transmit a raw serial telegram of exactly TELEGRAM_LEN bytes to the CMOOSSerialPort::GetTelegram() or GetTelegramOrAccumulate() code paths. No authentication is required on the serial interface, but the AV:P (Physical) attack vector confirmed by the CVSS 4.0 vector means remote network-based exploitation is not possible without an intermediate serial-to-network bridge explicitly exposing the port. Stack protection mechanisms present on modern Linux deployments (stack canaries, ASLR, NX) further condition whether the single-byte overwrite yields reliable code execution or instead triggers a process crash. The flaw affects all core-moos deployments through 10.4.0 that use the CMOOSSerialPort class; deployments that do not instantiate serial port communication are not exposed.

The CVSS 4.0 vector AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H assigns a Physical attack vector, which is the dominant risk-limiting factor - exploitation requires direct control of the serial communication line interfacing with the target hardware, restricting the attacker population to physically proximate actors, insiders, or supply-chain adversaries. Once serial-line access is secured, complexity is low and no authentication is required. Integrity and availability impacts are rated High, consistent with a one-byte stack overwrite that could corrupt saved control data and enable code execution; however, actual exploitability is further conditioned on stack layout, compiler mitigations (stack canaries, ASLR), and the target platform's ABI. The physical access barrier means a standard remotely-managed network perimeter provides no meaningful exposure, though autonomous platforms operating in field conditions with accessible hardware interfaces present a more realistic attack surface. No EPSS data was provided and this CVE is absent from CISA KEV, indicating no known active exploitation. No public proof-of-concept has been identified.

An attacker with physical access to the serial line on a MOOS-enabled autonomous marine or robotic platform sends a crafted telegram exactly TELEGRAM_LEN bytes long. The GetTelegram() loop allows nRead to reach TELEGRAM_LEN, after which the NUL-terminator write at pData[TELEGRAM_LEN] overwrites the adjacent stack byte - potentially corrupting a stack canary, saved return address, or frame pointer. Depending on the host platform's stack layout and mitigations, a carefully constructed telegram sequence could redirect execution to attacker-supplied shellcode or return-oriented programming gadgets.