CVE-2026-85455 in core-moos
Summary
by MITRE • 09/04/2026
MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte packet triggers out-of-bounds memory access during deserialization. Attackers can open a TCP connection to the MOOSDB port and send a crafted short packet to read memory before authentication.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The core-moos software suite, specifically versions up through 10.4.0, contains a critical buffer over-read vulnerability within its communication module, identified as CMOOSCommPkt. This flaw arises during the deserialization process of incoming network packets, where the application fails to adequately validate packet lengths against actual data availability. When an attacker establishes a TCP connection to the MOOSDB port and transmits a specifically crafted short packet consisting of only four bytes, the software attempts to read memory locations beyond the bounds of the allocated buffer. This out-of-bounds access occurs because the deserialization logic assumes that sufficient data is present for parsing without performing rigorous boundary checks prior to accessing specific fields within the packet structure.
From a technical perspective, this vulnerability represents an improper input validation error where the application does not verify that the received payload meets the minimum size requirements before attempting to extract structured data elements. The lack of bounds checking allows the program to read arbitrary memory contents located immediately preceding or following the intended buffer region in memory. This behavior is characteristic of CWE-125, which describes out-of-bounds read vulnerabilities. Such flaws are particularly dangerous because they can lead to information disclosure if the accessed memory contains sensitive data such as authentication tokens, cryptographic keys, or internal application states that were previously loaded into those memory addresses.
The operational impact of this vulnerability is significant due to its potential for remote exploitation without prior authentication. Since the attack vector involves sending a crafted packet directly to the MOOSDB port, an adversary can trigger the buffer over-read from a network position where they have connectivity to the target service. The immediate consequence is the leakage of internal memory contents back through the response or potentially causing application instability if the accessed data leads to subsequent processing errors. In the context of unmanned underwater vehicles and marine robotics systems that rely on MOOS for communication, such information disclosure could compromise system integrity by revealing architectural details or sensitive operational parameters to unauthorized entities.
This vulnerability aligns with MITRE ATT&CK technique T1046, Network Service Discovery, as it involves probing a specific service port to extract useful intelligence about the target environment. Furthermore, it relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, given that the primary risk is the unauthorized reading of memory contents. The ability to read arbitrary memory before authentication bypasses standard access controls, effectively allowing unauthenticated users to gain insights into the internal workings of the MOOS framework. This can facilitate further attacks by providing attackers with the necessary context to craft more sophisticated exploits targeting other components within the system.
Mitigation strategies should focus on immediate patching and defensive coding practices. Users running core-moos versions 10.4.0 or earlier are strongly advised to upgrade to a patched version where this deserialization logic has been corrected to include strict length validation before any memory access occurs. In scenarios where upgrading is not immediately feasible, network-level controls such as firewalls can be configured to restrict access to the MOOSDB port exclusively from trusted IP addresses, thereby reducing the attack surface. Additionally, implementing intrusion detection systems that monitor for anomalous packet sizes or unusual traffic patterns on marine robotics communication ports can help detect and block exploitation attempts in real-time. Developers should also adopt secure coding standards that mandate bounds checking during all deserialization operations to prevent similar vulnerabilities in future releases.