EUVD-2026-70800
GHSA-m984-rrgf-rcwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed MOOSDB port
-
DeliveryOpen connection, enter HandShake
-
ExploitSend packet with negative length
-
ExecutionBypass signed-int check in InflateTo/recv
-
PersistOverflow four-byte heap buffer
-
ImpactCorrupt heap, execute code as MOOSDB
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a MOOSDB (core-moos) broker's listening socket and the ability to send a crafted MOOSCommPkt during the initial HandShake phase; the attacker sets the packet length field to a negative value to bypass the signed-integer check in InflateTo() and the negative size conversion in recv(). No authentication, credentials, or user interaction are needed - the write occurs before authentication - so on any MOOSDB instance through version 10.4.0 the only limiting factor is network exposure of the broker port; deployments that isolate MOOSDB on segmented, VPN-gated, or air-gapped control networks are not remotely reachable. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) is consistent with the description of a pre-authentication, single-packet heap overflow reachable over the network with no user interaction, and the source diff independently confirms the negative-length signed-integer bug. The main tempering factor is exposure: MOOSDB is robotics/research middleware that is often deployed on isolated vehicle or lab networks rather than the open internet, so real-world reachability depends heavily on network segmentation, and even a mid-sized robotics operator should treat any internet- or shared-network-exposed MOOSDB as urgent. No EPSS score, KEV listing, or public PoC is present in the input, so exploitation is currently theoretical-but-credible; heap-overflow-to-RCE is plausible but weaponization difficulty is unknown and reliable code execution is not demonstrated by the available data. |
| Exploit ScenarioDerived | An attacker with network access to a MOOSDB instance opens a connection and, during the pre-authentication HandShake, sends a MOOSCommPkt whose length field is a negative value; the signed-integer check is bypassed and the negative size is converted during recv(), overflowing the four-byte heap buffer with attacker-controlled data. Depending on heap layout this corrupts adjacent structures and can lead to a crash or arbitrary code execution as the MOOSDB process. No public PoC is identified, but VulnCheck has documented the vulnerable code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Remote code execution risk in MOOS core-moos through 10.4.0 arises from a pre-authentication heap overflow in MOOSCommPkt packet handling, where a remote attacker declares a negative packet length to write arbitrary data into a four-byte heap buffer during the connection HandShake, before any authentication occurs. Any exposed MOOSDB robotics-middleware instance is affected, and because the flaw is triggered by an attacker-controlled length read straight off the wire, it can be reached with a single crafted packet. No public exploit identified at time of analysis, though the issue was reported and detailed by VulnCheck and a fix is available.
RemediationAI
Patch available per vendor advisory: apply the fix from GitHub PR #82 (commit 96c49c5cdda6e07ee734a5324e8d25ba5a7f2d7a), which rejects negative packet lengths in CMOOSCommPkt; upgrade to a build incorporating this commit - no independently confirmed tagged release version is available in the input, so track the themoos/core-moos repository for the next release past 10.4.0. Until patched, restrict network reachability of the MOOSDB listening port to trusted hosts only (firewall/ACL or bind to loopback/segmented VLANs), since the flaw is pre-authentication and the middleware has no built-in access control at the HandShake stage; the trade-off is that any legitimate remote MOOS clients must be explicitly allowlisted, which can break distributed robotics deployments if peers are not enumerated. Where feasible, place MOOSDB behind a VPN or on an air-gapped control network so the malformed-packet path is unreachable from untrusted sources.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MOOS (Mission Oriented Operating Suite) is a publish/subscribe communications middleware widely used in marine and mobile robotics; core-moos (cpe:2.3:a:themoos:core-moos) provides the MOOSDB broker and the CMOOSCommPkt wire-packet abstraction. The root cause is CWE-787 (out-of-bounds write): the packet length field is read from the network into a signed integer and then used both to size the internal stream (InflateTo()) and as the length argument passed to recv() via GetBytesRequired(). A negative value bypasses the signed-integer sanity check and, when converted for recv(), becomes a large size, so data is written past the small heap allocation. The upstream fix (PR #82 / commit 96c49c5) adds explicit nNewStreamSize < 0 and m_nMsgLen < 0 rejections so negative lengths are refused rather than silently honored.
Know when Core Moos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Pre-auth single-packet network overflow (AV:N/AC:L/PR:N/UI:N); heap write yields memory corruption and likely code exec, so C/I/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.
Executive ViewAI
MOOS core-moos versions through 10.4.0 contain a critical pre-authentication remote code execution vulnerability enabling attackers to compromise any exposed MOOSDB instance with a single network packet; no public exploit has been identified at time of analysis. Organizations using MOOSDB for robotics, autonomous systems, or industrial control face immediate compromise risk if systems are exposed to untrusted networks. The flaw requires no authentication or user interaction, necessitating immediate patching and network isolation as urgent priority actions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated variable write in MOOS core-moos through 10.4.0 lets any client that can reach the optional MOOSDB HTTP
Unauthenticated full compromise of the MOOSDB message bus in MOOS core-moos through 10.4.0, where the wire protocol perf
Unauthenticated buffer over-read in MOOS core-moos through 10.4.0 allows any attacker with TCP access to the MOOSDB port
MOOSDB in core-moos through 10.4.0 accepts wire-supplied source identifiers verbatim instead of enforcing the authentica
Uncontrolled memory allocation in MOOS core-moos through 10.4.0 exposes MOOSDB servers to pre-authentication denial of s
Unauthenticated denial-of-service in MOOS core-moos through 10.4.0 allows remote attackers to crash the central MOOSDB p
Resource exhaustion in the MOOSDB HTTP server component of MOOS core-moos through 10.4.0 allows unauthenticated remote a
Denial-of-service in MOOS core-moos through 10.4.0 allows any unauthenticated network peer to permanently freeze the MOO
Remote process termination in MOOS core-moos through 10.4.0 allows any multicast-reachable attacker to forcibly shut dow
Stored cross-site scripting in MOOS core-moos through 10.4.0 allows any MOOS publisher to inject script payloads into th
Stack corruption with potential code execution in MOOS core-moos through version 10.4.0 arises from an off-by-one error
Exploit-DB