CVE-2026-85442 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in MOOS core versions through 10.4.0 represents a critical failure in input validation within the CMOOSCommPkt::OnBytesWritten() function, specifically concerning the handling of packet length declarations during network communication. This flaw allows unauthenticated attackers to exploit the system before any authentication mechanisms are engaged, creating a window of opportunity for denial-of-service attacks that target server resources rather than application logic or data integrity directly. The core issue stems from the software's assumption that declared packet lengths in incoming wire packets accurately reflect the actual size of the payload being transmitted. By failing to validate these declarations against expected bounds or available memory constraints prior to allocation, the system becomes susceptible to resource exhaustion attacks where malicious actors send crafted packets with artificially inflated length fields.
From a technical perspective, this vulnerability is classified under CWE-134: Use of Externally-Controlled Format String and more accurately CWE-789: Uncontrolled Memory Allocation when considering the specific outcome of unbounded buffer allocation. When an attacker sends a packet declaring a significantly larger size than what is actually present or reasonable for normal operation, the CMOOSCommPkt::OnBytesWritten() routine proceeds to allocate memory corresponding to this false declaration. This process occurs during the initial stages of connection handling, meaning that no user credentials are required to trigger the exploit. The lack of pre-allocation checks allows a single crafted packet to request megabytes or gigabytes of RAM depending on the integer size used for length fields, leading directly to rapid memory consumption by the MOOS server process.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition that affects system availability and stability. As the server attempts to allocate excessive amounts of memory based on malicious inputs, it quickly exhausts available physical RAM or swap space. This resource depletion causes the application to become unresponsive, crash due out-of-memory errors, or force the operating system to terminate the process via its Out-Of-Memory killer mechanisms. In environments where MOOS is used for autonomous vehicle control, robotics coordination, or other real-time critical systems, such instability can lead to significant operational disruptions, potential safety hazards if fail-safes are not robust enough, and increased downtime for maintenance and recovery efforts. The attack vector is particularly dangerous because it requires no prior authentication, making it accessible to any network actor with connectivity to the MOOS communication port.
This vulnerability aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically sub-technique T1498.003 which involves resource exhaustion through application layer attacks. The exploitation path leverages the trust placed in network protocol headers without sufficient verification, a common pattern in legacy or less rigorously audited communication stacks. To mitigate this risk, developers must implement strict input validation within the CMOOSCommPkt::OnBytesWritten() function and related packet parsing routines. This includes enforcing maximum allowable packet sizes based on system capabilities and application requirements, validating that declared lengths do not exceed buffer capacities before memory allocation occurs, and implementing rate limiting or connection throttling to prevent rapid-fire requests from overwhelming resources even if individual packets are within bounds. Additionally, deploying network-level intrusion detection systems can help identify anomalous traffic patterns indicative of such exploitation attempts by monitoring for unusually large packet declarations in real-time communications.