CVE-2026-85442highCWE-789

CVE-2026-85442: high-severity vulnerability in themoos core-moos

MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation

Published · Updated

Follow this CVE+ Monitor core-moos

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.8%
MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
themoos · core-moos
Related CVEs — themoos core-moos

In the same product, most dangerous first.

CVE-2026-85440CRITICALMOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet LengthEPSS 1.0%CVE-2026-85428CRITICALMOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable WriteEPSS 0.8%CVE-2026-85424CRITICALMOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAREPSS 0.8%CVE-2026-85455HIGHMOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short PacketEPSS 0.7%CVE-2026-85441HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String LengthEPSS 0.7%CVE-2026-85450HIGHMOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource ExhaustionEPSS 0.6%