Mooncake Transfer Engine EUVD-2026-91136

Exploitation requires network reachability to the Mooncake transfer engine's TCP transport data port (the socket handling SessionHeader messages in ServerSession::readHeader); the attacker then sends a SessionHeader with attacker-chosen addr and size fields using a READ or WRITE opcode. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and default deployments of the TCP transport expose this port. The practical limiting factor is network exposure: Mooncake data ports are typically bound within a trusted LLM-serving cluster/back-end network, so risk is highest where that port is reachable by untrusted hosts (flat networks, misconfigured segmentation, or internet exposure) and lower where the data plane is isolated. Only versions before 0.3.13 are affected.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication, no special attack requirements, and no user interaction, with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) - the maximum exploitability profile short of a scope change. CWE-822 (untrusted pointer dereference) combined with the description's claim of attacker-controlled addr/size in READ or WRITE opcodes means an unauthenticated attacker gets a primitive for arbitrary process-memory read AND write, which is directly weaponizable toward both data disclosure (KV cache, prompts, secrets) and code execution. The flaw is corroborated by independent source-code evidence: a vendor patch commit (a2933849) and the vulnerable code path in tcp_transport.cpp, and it was reported by a reputable research vendor (VulnCheck) with its own advisory. Key caveats: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public exploit code referenced, so there is no evidence of active exploitation - the 'RCE' tag reflects potential impact, not observed in-the-wild attacks. The CVSS network vector is fully consistent with the description (TCP transport data port), so there is no signal conflict; the primary unknown is real-world exposure of the data port, which is typically on an internal cluster network rather than the public internet.

An attacker with network reachability to a Mooncake transfer engine's TCP transport data port connects and sends a crafted SessionHeader carrying an arbitrary memory address and size with a READ opcode, causing ServerSession::readHeader to dereference the untrusted pointer and return the contents of that memory region - disclosing cached KV data, prompts, or secrets. Using a WRITE opcode with a controlled address, the same primitive corrupts process memory to pivot toward remote code execution. No public exploit code is referenced in the available data, but the vendor patch and VulnCheck advisory confirm the bug's existence and exploitability.